Sigillum Validator

Cryptographically verify the chain of trust from root to domain with RDAP and DNS.

Powered by Any53

Try:
About this tool

Sigillum Validator performs iterative DNSSEC validation from the root zone down to your target domain. Unlike a recursive resolver that simply gives you a pass/fail, this tool shows you exactly what's happening at each step:

  • Zone discovery - Identifies actual zone cuts (delegation points) in the DNS hierarchy
  • DNSKEY verification - Fetches and cryptographically verifies DNSKEY records at each zone
  • DS chain validation - Verifies that each zone's KSK matches the DS record in its parent zone
  • Signature validation - Cryptographically verifies DNSKEY, DS, and record-level RRSIG signatures
  • RDAP verification - Compares DS records from DNS against the registry database via RDAP
  • CNAME following - Automatically validates CNAME target chains

Validation results: secure (full chain verified), insecure (zone not signed), bogus (validation failed), indeterminate (could not determine).

JSON API

Queries authoritative nameservers directly using IANA root trust anchors.

curl -s 'https://www.any53.com/dnssec/api/validate?domain=www.any53.com' | jq '.result, .chain[].zone'