DNSSEC Checker API

GET

Catch broken DNSSEC setups before domains stop resolving.

DNSSEC Checker validates the DNSSEC (Domain Name System Security Extensions) configuration of a domain. It verifies that DNS responses are authenticated and haven't been tampered with.

Try it — live request, no key required

Request

GETapi.apiverve.com/v1/dnsseccheck?domain=cloudflare.com

Query parameters

domainstring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "domain": "cloudflare.com",
    "dnssecEnabled": true,
    "valid": true,
    "records": {
      "dnskey": 2,
      "ds": 1,
      "nsec": 1
    },
    "errors": [],
    "details": {
      "dnskeyCount": 2,
      "dsCount": 1
    },
    "status": "DNSSEC is properly configured with DS records at parent",
    "recommendation": "DNSSEC is properly configured",
    "riskScore": 5,
    "riskLevel": "low"
  }
}

About the DNSSEC Checker API

DNSSEC Checker works by querying DNSKEY, DS, and RRSIG records for a domain and validating the cryptographic chain of trust. It identifies whether DNSSEC is properly configured, highlights any validation errors, and derives a deployment-health risk score that distinguishes an unhardened domain from one with a broken chain of trust.

What people use it for

Security Auditing: Verify that domains have properly configured DNSSEC to prevent DNS spoofing and cache poisoning attacks
Compliance Checking: Ensure domains meet security compliance requirements that mandate DNSSEC
Domain Monitoring: Monitor DNSSEC status and get alerts if configuration becomes invalid
Troubleshooting: Diagnose DNSSEC validation failures and identify misconfigured records

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

How it compares

Side by side with the tools people weigh DNSSEC Checker against — what each one is better at, in plain terms.

APIVerve vs MXToolbox →APIVerve vs EasyDMARC →

Other ways to use DNSSEC Checker

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the DNSSEC Checker API.

Read the docs →

What records does the validation check?

It queries DNSKEY, DS, and RRSIG records to verify the domain's cryptographic chain of trust. The check also inspects parent DS records, zone DNSKEY counts, and any NSEC or NSEC3 records used to prove authenticated non-existence.

What happens if a domain has not configured DNSSEC at all?

The response reports that DNSSEC is not enabled, and the errors array remains empty because an unconfigured domain is not treated as a broken signature chain. On paid plans, DNSSEC Checker uses its deployment health risk score to separate an unhardened domain from one suffering from validation failures.

Do I get the deployment risk score and record breakdown on the Free plan?

No. The Free plan returns validation status, basic errors, and recommendations. Access to the composite risk score, risk level band, and detailed DNSKEY, DS, and NSEC record structures requires upgrading to any paid plan.

Which plan fits auditing 5,000 domains a month?

The Starter plan comfortably handles that volume. Because each check uses 10 credits, 5,000 audits require 50,000 credits, using one quarter of Starter's 200,000 monthly credits. That works out to about $1.50 per 1,000 calls, whereas the Free plan provides 20 calls each month.

How fresh are the DNSSEC validation results?

Results are evaluated in real time on every call. The service queries live DNSKEY, DS, and signature records directly to inspect the active zone rather than serving data from a stale cache or pre-scanned list.

Request parameters — GET /v1/dnsseccheck

Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`domain`Required	string	`cloudflare.com`	The domain name to check DNSSEC configuration for domain

Example request

1
2

curl "https://api.apiverve.com/v1/dnsseccheck?domain=cloudflare.com" \
  -H "x-api-key: YOUR_API_KEY"

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — GET /v1/dnsseccheck

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "domain": "cloudflare.com",
    "dnssecEnabled": true,
    "valid": true,
    "records": {
      "dnskey": 3,
      "ds": 2,
      "nsec": "NSEC3"
    },
    "errors": [],
    "details": {
      "dnskeyCount": 3,
      "dsCount": 2
    },
    "status": "DNSSEC is properly configured with DS records at parent",
    "recommendation": "DNSSEC is properly configured",
    "riskScore": 5,
    "riskLevel": "low"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`domain`	string	`"cloudflare.com"`	Domain that was checked
`dnssecEnabled`	boolean	`true`	Whether DNSSEC is enabled
`valid`	boolean	`true`	Whether DNSSEC configuration is valid
`records`Premium	object	`{...}`	DNSKEY and DS record details
`dnskey`Premium	number	`3`	Number of DNSKEY records published by the zone
`ds`Premium	number	`2`	Number of DS records held by the parent zone
`nsec`Premium	string	`"NSEC3"`	Number of NSEC or NSEC3 records used to prove non-existence; null when none were returned
`errors`	array	`[]`	Problems found in the chain of trust; empty when DNSSEC validates
`details`	object	`{...}`	Record counts behind the verdict
`dnskeyCount`	number	`3`	Number of DNSKEY records seen
`dsCount`	number	`2`	Number of DS records seen at the parent
`status`	string	`"DNSSEC is properly configured with DS records at parent"`	Plain-language verdict on the domain's DNSSEC configuration
`recommendation`	string	`"DNSSEC is properly configured"`	What to do about the current configuration
`riskScore`Premium	number	`5`	Composite 0-100 DNSSEC deployment-health score. A fully valid chain of trust scores low; a domain that published keys but never lodged its DS record at the parent zone (a broken chain that can break resolution) scores high; an undeployed domain scores in between
`riskLevel`Premium	string	`"low"`	Risk band derived from the score: low, medium or high

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 10 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	DNSSEC Checker calls	Per 1,000 calls
Free	Free	200	20	Free
Starter	$29.99	200,000	20,000	$1.50
Pro	$99.99	1,000,000	100,000	$1.00
Mega	$299.99	4,000,000	400,000	$0.75

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — GET /v1/dnsseccheck

No SDK to install — this is a plain HTTPS call to /v1/dnsseccheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/dnsseccheck" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/dnsseccheck-apiSource, issues and the examples this page is built from.ReferenceDNSSEC Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/dnssecchecknpm APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — GET /v1/dnsseccheck

Install the Node.js SDK, then call the DNSSEC Checker API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/dnsseccheck

Node.js

const res = await fetch("https://api.apiverve.com/v1/dnsseccheck", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/dnsseccheckThe published Node.js client, versioned and signed.GitHubapiverve/dnsseccheck-apiSource, issues and the examples this page is built from.ReferenceDNSSEC Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — GET /v1/dnsseccheck

No SDK to install — this is a plain HTTPS call to /v1/dnsseccheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/dnsseccheck",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

Also published for

@apiverve/dnssecchecknpm APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — GET /v1/dnsseccheck

Install the C# / .NET SDK, then call the DNSSEC Checker API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.DNSSECChecker

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/dnsseccheck");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.DNSSECCheckerThe published C# / .NET client, versioned and signed.GitHubapiverve/dnsseccheck-apiSource, issues and the examples this page is built from.ReferenceDNSSEC Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/dnssecchecknpm

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — GET /v1/dnsseccheck

No SDK to install — this is a plain HTTPS call to /v1/dnsseccheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/dnsseccheck", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/dnssecchecknpm APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — GET /v1/dnsseccheck

No SDK to install — this is a plain HTTPS call to /v1/dnsseccheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/dnsseccheck");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/dnssecchecknpm APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — GET /v1/dnsseccheck

No SDK to install — this is a plain HTTPS call to /v1/dnsseccheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/dnsseccheck")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/dnssecchecknpm APIVerve.API.DNSSECCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

All articles →

7 SSL Certificate Problems That Kill TrustExpired certs, mismatched domains, weak encryption. A practical checklist for catching SSL issues before your users do.Read

DNS Lookups: A Developer's Debugging GuideDNS problems cause connection failures and email issues. Learn how to use DNS lookups to diagnose problems faster.Read

WHOIS Data: Domain Intelligence for Business and SecurityWHOIS data reveals domain ownership, age, and infrastructure. Use it for lead qualification, research, and fraud detection.Read

DNSSEC Checker API

Try it — live request, no key required

About the DNSSEC Checker API

What people use it for

Ways to call it

How it compares

Other ways to use DNSSEC Checker

Questions.

Request parameters — GET /v1/dnsseccheck

Required

Authentication

Response — GET /v1/dnsseccheck

Response fields

Response headers

Errors

What a call costs — 10 credits per call

Call it from cURL — GET /v1/dnsseccheck

Resources

Also published for

Call it from Node.js — GET /v1/dnsseccheck

Resources

Also published for

Call it from Python — GET /v1/dnsseccheck

Resources

Also published for

Call it from C# / .NET — GET /v1/dnsseccheck

Resources

Also published for

Call it from Go — GET /v1/dnsseccheck

Resources

Also published for

Call it from PHP — GET /v1/dnsseccheck

Resources

Also published for

Call it from Ruby — GET /v1/dnsseccheck

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — DNSSEC Checker API

Domain Data

Related articles

Ready to build with DNSSEC Checker? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog