DNSSEC Check — by CyprNet Secure
Professional DNSSEC analysis and verification at your fingertips.

Perform deep trust-chain validation, cryptographic audits, and standards-compliant reporting for any domain — all powered by the CyprNet Secure TrustPath Engine.

— End-to-End DNSSEC Analysis —
• Parent → child zone validation with authoritative-direct probing (DO=1, UDP 1232, TCP fallback)
• Operates through corporate recursive resolvers when direct probing is restricted
• DS ↔ DNSKEY mapping with match coverage
• SHA-1 detection and crypto-grade scoring
• RFC 8078 support: detect CDS/CDNSKEY for automated trust-anchor updates
• Unified TrustReport model powering UI and HTML reports

— Free (Analysis) Experience —
• Trust Chain Integrity: compact DS↔DNSKEY summary, parent zone info, match counts
• Cryptographic Profile: SHA-1 cap indicator; DNSKEY algorithm list
• Coverage of Signed RRsets: overall % from scoring
• DS/DNSKEY/RRSIG previews (truncated) with copy support
• Top Finding (1 bullet)
• Divider + “Open Full Report (Pro)”
• Six Pro preview cards (headline metric visible; details blurred):
– Key Lifecycle & Expiry Audit (earliest expiry days)
– Parent ↔ Child Linkage Deep Dive (matches X/Y; SHA-1 badge when present)
– Per-Nameserver Validation (authoritatives count)
– Negative Answer Validation (NSEC/NSEC3 mechanism)
– Resolver & Corporate Capabilities (DO support Yes/No)
– Advanced Findings & Mitigation (additional findings +N)

— Pro Capabilities —
• Delegation (CDS/CDNSKEY): presence detection, counts, TTL; guidance when missing (RFC 5011)
• Parent ↔ Child Linkage: DS digest ↔ DNSKEY tag mapping, SHA-1 warnings, copyable records
• Cryptographic Profile: algorithm distribution, KSK/ZSK counts, earliest/median RRSIG expiry
• Coverage of Signed RRsets: SOA, NS, DNSKEY, apex A/AAAA, MX; notes for TXT/SPF/DKIM/DMARC/CAA
• Per-Nameserver Evidence: EDNS/DO/TCP, TC seen, SOA serial consistency, RRSIG matrix per RRset
• Negative Answer Validation: NXDOMAIN/NODATA with NSEC/NSEC3, iterations, salt, opt-out, Validated
• Resolver & Corporate Capabilities: resolver samples (RD/DO/CD/AD), per-resolver capability chips
• Findings & Recommendations: Critical / Warning / Info; items link to report anchors; auto finding when Parent DS RRSIG < 3 days

— Mobile-First HTML Report —
• Sticky header: domain, UTC timestamp, vantage, score chips
• Sticky mini-TOC; Expand All / Collapse All
• Sections: Trust Chain → Parent↔Child → Delegation (DS/CDS/CDNSKEY) → Crypto → Coverage → Per-NS → Negative → Resolver → Findings → Artifacts → Appendix
• Print expands all sections; teaser blur retained
• Artifacts: HTML/JSON paths, copy actions, optional SHA-256 hash; footer with schemaVersion, generator version, capture time (UTC)
• Professional logo and branding in Pro version for security professionals.

— Data & Model —
• Single snapshot TrustReport powering UI and report
• UTC everywhere; ISO-8601 timestamps
• IPv4-only probing; warning when NS is IPv6-only

— Accessibility & UX —
• Material 3; neutral palette; contrast ≥ 4.5:1
• 48dp touch targets; content descriptions for icons
• Color semantics: success (green), warning (amber), error (red), info (blue), locked ribbon (neutral/indigo)
• Density toggle: Compact / Comfortable in Analysis and Pro

— Sharing & Export —
• Pro: Generate, Share, Email wired to written artifacts
• SAF-based export on modern Android; guarded legacy storage

— Vantage Modes —
• Authoritative-Direct: probes authoritative NS (RD=0, DO=1) with TCP fallback
• Corporate-Recursive: labels resolvers; shows samples and capabilities; notes limitations

— Roadmap —
• Populate EDNS size/TCP per resolver when available from sampling
• Extend fixtures for RRSIG/NSEC3 verification testing
• Optional IPv6 probing mode; dual-stack heuristics

Built by CyprNet Secure — Trusted tools for network and security professionals.
Analyze. Validate. Trust.