DNSSEC

DNSSEC.sh is a browser-based diagnostic service that helps users see what their internet connection and DNS resolvers reveal about DNS security and network behavior. A check examines the resolvers in use, whether they validate DNSSEC, the user’s IPv4 and IPv6 paths, potential EDNS Client Subnet (ECS) leaks, and the TLS handshake. It also reports IP address, reverse DNS, and geolocation information where available.

The service tests DNSSEC handling by checking whether resolvers accept a correctly signed response and refuse responses with invalid, expired, or missing signatures. Its listed signature tests cover ECDSA P-256, ECDSA P-384, Ed25519, and ML-DSA-44. TLS reporting includes connection status and support for TLS 1.2 and TLS 1.3.

DNSSEC.sh offers read-only links for replaying a recent check, while making clear that opening a replay does not run new probes under the shared label. Reports are held in memory and deleted after ten minutes without a query. The site states that it uses no cookies or accounts and that its own domain is DNSSEC-signed.