DNSSEC Check
We query the DS records in the parent zone, the zone's DNSKEY set and its signatures, and ask a validating resolver whether the answer validates.
DNSSEC lets a resolver verify that a DNS answer really comes from the zone’s owner. It works as a chain of trust: the parent zone (for example .fi) publishes a DS record that fingerprints the zone’s key-signing key; the zone publishes its keys as DNSKEY records and signs its data with RRSIG records; a validating resolver follows the chain down from the root and sets the AD flag on answers it could verify.
This check queries the DS records at the parent, the DNSKEY set and its signatures, and asks our resolver whether the answer validated. It also checks that a DS record’s key tag matches a key in the zone, the most common thing to break when keys are rolled or a domain moves to a new DNS host.
The .fi registry supports DNSSEC, and many Finnish domains are signed. An unsigned domain is not broken; it is simply not protected against forged answers.
Frequently asked questions
What does 'signed but not validating' mean?
The parent publishes DS records, but the resolver did not accept the zone's signatures. Validating resolvers then answer SERVFAIL, so the domain can disappear for users of those resolvers. A common cause is a DS record left behind after moving to a DNS host with different keys.
Do I need DNSSEC?
It protects against forged DNS answers (cache poisoning) and is required by some security mechanisms such as DANE. Your DNS host and registrar must both support it.
Why is the result for www.example.fi about example.fi?
DNSSEC is configured per zone. A host name inside a zone is covered by that zone's keys, so the check reports on the zone that contains the name.