Made in / Donate

DNS lookup

Everything DNS says about a domain: traced from the root servers down, every record type asked of the domain's own nameservers, each nameserver checked, then every hostname and policy record it points at followed, with SPF, DMARC, DKIM and DNSSEC checked along the way.

Try example.com, gmail.com, www.github.com, dnssec-failed.org, 1.1.1.1. A URL, e-mail address or IP address works too.

dnssec-failed.org

Zone dnssec-failed.org281 queries in 5.0 s2026-11-09 05:00:49 UTCDNSSEC failing

WHOIS for dnssec-failed.org →TextJSON
  • Problem DNSSEC is broken: none of the DS records at the parent matches a DNSKEY in dnssec-failed.org. Validating resolvers (most ISPs, Google, Cloudflare) will refuse to resolve it.
  • Problem Validating resolvers return SERVFAIL for dnssec-failed.org while its nameservers answer: a DNSSEC failure.
  • Problem The RRSIG over DNSKEY expired on 2026-07-02 22:57 UTC. Validating resolvers will reject it.
  • Warning No DMARC record at _dmarc.dnssec-failed.org: receivers get no policy for mail that fails SPF and DKIM, and you get no reports.
  • Note No CAA records: any certificate authority may issue certificates for dnssec-failed.org.

Records

Asked directly of dns101.comcast.net (69.252.250.103), an authoritative server: no cache in between, so these are the live values. Each set is DNSSEC-signed.

A IPv4 address

300A96.99.227.255

NS Nameservers

7200NSdns103.comcast.net.
7200NSdns104.comcast.net.
7200NSdns105.comcast.net.
7200NSdns101.comcast.net.
7200NSdns102.comcast.net.

SOA Zone authority

86400SOAdns101.comcast.org. dnsadmin.comcast.net. 2010102614 900 180 604800 7200

Primary dns101.comcast.org · contact dnsadmin@comcast.net · serial 2010102614 · refresh 15 min · retry 3 min · expire 7 d · negative TTL 2 h

TXT Text

7200TXT"v=spf1 -all"

DNSKEY DNSSEC keys

3600DNSKEY256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg==
3600DNSKEY257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg==
ANY query: 11 records
7200NSdns104.comcast.net.
7200NSdns105.comcast.net.
7200NSdns101.comcast.net.
7200NSdns102.comcast.net.
7200NSdns103.comcast.net.
300A96.99.227.255
7200TXT"v=spf1 -all"
7200NSECwww.dnssec-failed.org. A NS SOA TXT RRSIG NSEC DNSKEY
3600DNSKEY257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg==
3600DNSKEY256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg==
86400SOAdns101.comcast.org. dnsadmin.comcast.net. 2010102614 900 180 604800 7200

No records of type AAAA, CNAME, DNAME, MX, CAA, HTTPS, SVCB, SRV, NAPTR, DS, CDS, CDNSKEY, NSEC3PARAM, TLSA, SSHFP, LOC, HINFO, RP, URI, SPF, OPENPGPKEY, ZONEMD, CSYNC, PTR.

Resolution trace

  1. .asked h.root-servers.net 198.97.190.536.1 ms

    Referral to org. signed (2 DS)

    • d0.org.afilias-nst.org 199.19.57.1 2001:500:f::1
    • a2.org.afilias-nst.info 199.249.112.1 2001:500:40::1
    • b2.org.afilias-nst.org 199.249.120.1 2001:500:48::1
    • v0n0.pir-ns.org 199.19.56.1 2001:500:e::1
    • v0n1.pir-ns.org 199.19.54.1 2001:500:c::1
    • v0n2.pir-ns.org 199.19.53.1 2001:500:b::1
  2. org.asked d0.org.afilias-nst.org 199.19.57.111 ms

    Referral to dnssec-failed.org. signed (1 DS)

    • dns102.comcast.net 68.87.85.132 2001:558:1004:7:68:87:85:132
    • dns103.comcast.net 68.87.76.228 2001:558:1014:c:68:87:76:228
    • dns105.comcast.net 68.87.72.244 2001:558:100e:5:68:87:72:244
    • dns101.comcast.net 69.252.250.103 2001:558:fe23:8:69:252:250:103
    • dns104.comcast.net 68.87.68.244 2001:558:100a:5:68:87:68:244

    No glue for dns102.comcast.net, dns103.comcast.net, dns105.comcast.net, dns101.comcast.net, dns104.comcast.net: addresses looked up via a resolver.

    199.19.54.1 failed: NOERROR

  3. dnssec-failed.org.asked dns101.comcast.net 69.252.250.103101 ms

    Answer (authoritative):

    dnssec-failed.org.300A96.99.227.255

    68.87.76.228 failed: NOERROR

Nameservers

Every address of every nameserver, asked for dnssec-failed.org's SOA. "Parent" means the org zone delegates to it; "zone" means dnssec-failed.org lists it itself.

NameserverListed inAddressStatusSerialTime
dns101.comcast.netparent + zone69.252.250.103 glueauthoritative201010261497 ms
2001:558:fe23:8:69:252:250:103 glueauthoritative201010261497 ms
dns102.comcast.netparent + zone68.87.85.132 glueauthoritative2010102614140 ms
2001:558:1004:7:68:87:85:132 glueauthoritative2010102614155 ms
dns103.comcast.netparent + zone68.87.76.228 glueauthoritative2010102614164 ms
2001:558:1014:c:68:87:76:228 glueauthoritative2010102614156 ms
dns104.comcast.netparent + zone68.87.68.244 glueauthoritative2010102614120 ms
2001:558:100a:5:68:87:68:244 glueauthoritative2010102614110 ms
dns105.comcast.netparent + zone68.87.72.244 glueauthoritative2010102614127 ms
2001:558:100e:5:68:87:72:244 glueauthoritative2010102614115 ms

DNSSEC

dnssec-failed.org is signed, and the org. zone vouches for it with 1 DS record.

Validating resolvers: Cloudflare SERVFAIL Google SERVFAIL

DS at the parent

Key tagAlgorithmDigestMatches a DNSKEY
4206913 ECDSAP256SHA256SHA-256no key with this tag

DNSKEYs in the zone

Key tagRoleAlgorithmSize
32784ZSK (signs records)13 ECDSAP256SHA256256 bits
50719KSK (signs keys)13 ECDSAP256SHA256256 bits

Signatures

OverValid fromExpiresLeft
DNSKEY2026-03-04 22:572026-07-02 22:57 UTCexpired
A2026-11-04 22:522026-11-12 01:57 UTC2.9 d
NS2026-11-04 22:522026-11-12 01:57 UTC2.9 d
SOA2026-11-04 22:522026-11-12 01:57 UTC2.9 d
TXT2026-11-04 22:522026-11-12 01:57 UTC2.9 d
NSEC2026-11-04 22:522026-11-12 01:57 UTC2.9 d

Email

Mail servers (MX)

No MX records: mail goes to the name's A/AAAA address, if anything accepts it there.

SPF

v=spf1 -all

Needs 0 of 10 DNS lookups. Expanded:

  • -all

DMARC

No DMARC record.

DKIM

None of the 36 common selectors tried has a key. DKIM may still be set up under another selector: find it in the DKIM-Signature header (s=) of a mail from this domain.

Hosts and reverse DNS

Every hostname the records point at, resolved to its addresses; each address's PTR (reverse DNS), with ✓ where the PTR name resolves back to the same address.

HostAddressReverse DNS (PTR)
dnssec-failed.org
the name looked up
SERVFAIL
dns101.comcast.net
nameserver
69.252.250.103dns101.comcast.net ✓
2001:558:fe23:8:69:252:250:103dns101.comcast.net ✓
dns102.comcast.net
nameserver
68.87.85.132dns102.comcast.net ✓
2001:558:1004:7:68:87:85:132dns102.comcast.net ✓
dns103.comcast.net
nameserver
68.87.76.228dns103.comcast.net ✓
2001:558:1014:c:68:87:76:228dns103.comcast.net ✓
dns104.comcast.net
nameserver
68.87.68.244dns104.comcast.net ✓
2001:558:100a:5:68:87:68:244dns104.comcast.net ✓
dns105.comcast.net
nameserver
68.87.72.244dns105.comcast.net ✓
2001:558:100e:5:68:87:72:244dns105.comcast.net ✓

Public resolvers

What four public resolvers answer right now, from their caches. Highlighted values differ from the authoritative answer: either a recent change they haven't picked up yet (the TTL says how long until they do), or, for A and AAAA, a CDN or geo-routed site handing each resolver location its own addresses.

ResolverAAAAAMX
Cloudflare 1.1.1.1SERVFAILSERVFAILSERVFAIL
Google 8.8.8.8SERVFAILSERVFAILSERVFAIL
Quad9 9.9.9.9timed outtimed outSERVFAIL
OpenDNS 208.67.222.222SERVFAILSERVFAILSERVFAIL

Text dump

; DNS report for dnssec-failed.org
; 2026-11-09 05:00:49 UTC, 281 queries in 5.03 s, zone dnssec-failed.org

;; FINDINGS
;  [ERROR] DNSSEC is broken: none of the DS records at the parent matches a DNSKEY in dnssec-failed.org. Validating resolvers (most ISPs, Google, Cloudflare) will refuse to resolve it.
;  [ERROR] Validating resolvers return SERVFAIL for dnssec-failed.org while its nameservers answer: a DNSSEC failure.
;  [ERROR] The RRSIG over DNSKEY expired on 2026-07-02 22:57 UTC. Validating resolvers will reject it.
;  [WARN] No DMARC record at _dmarc.dnssec-failed.org: receivers get no policy for mail that fails SPF and DKIM, and you get no reports.
;  [INFO] No CAA records: any certificate authority may issue certificates for dnssec-failed.org.

;; RECORDS (authoritative, from dns101.comcast.net (69.252.250.103))
dnssec-failed.org.	300	IN	A	96.99.227.255
dnssec-failed.org.	300	IN	RRSIG	A 13 2 300 20261112015706 20261104225206 32784 dnssec-failed.org. ly8U4zaWAZO8eGV6YRuTVspt+7pGoYI6whelFqGx9y6tOOSF3g3S2k0vCirY4GKRd89/5EykN3GvTbrCrGPwzw==
dnssec-failed.org.	7200	IN	NS	dns103.comcast.net.
dnssec-failed.org.	7200	IN	NS	dns104.comcast.net.
dnssec-failed.org.	7200	IN	NS	dns105.comcast.net.
dnssec-failed.org.	7200	IN	NS	dns101.comcast.net.
dnssec-failed.org.	7200	IN	NS	dns102.comcast.net.
dnssec-failed.org.	7200	IN	RRSIG	NS 13 2 7200 20261112015706 20261104225206 32784 dnssec-failed.org. 0Xb8zQqG8rNSrgag6tQ1MAJzcfvCXX1uhXQ/2Rf+KVGl2kBmIk0loI4FsrkFqNZATr/2R6wUpTR+IWz6SIyqAA==
dnssec-failed.org.	86400	IN	SOA	dns101.comcast.org. dnsadmin.comcast.net. 2010102614 900 180 604800 7200
dnssec-failed.org.	86400	IN	RRSIG	SOA 13 2 86400 20261112015706 20261104225206 32784 dnssec-failed.org. VNLgZhIM6kdPBIbfb68218ICNoUtCoIizJeWzp3tAr1FYsbtI+o5RHyEAjGvTu0niRnSV+YiAJDEYrCbq9Vsrg==
dnssec-failed.org.	7200	IN	TXT	"v=spf1 -all"
dnssec-failed.org.	7200	IN	RRSIG	TXT 13 2 7200 20261112015706 20261104225206 32784 dnssec-failed.org. SQdGkyNFxsORWq71CV58TwO/IslD+c72VDAaRoXgjK+x4haq9qU3sU4cjCPvn0/gClgZe4nQVVnHun21h+Ms4g==
dnssec-failed.org.	3600	IN	DNSKEY	256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg==
dnssec-failed.org.	3600	IN	DNSKEY	257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg==
dnssec-failed.org.	3600	IN	RRSIG	DNSKEY 13 2 3600 20260702225706 20260304225706 50719 dnssec-failed.org. lKlwCpp4weU8+JmndESAckuF6etEHyK1erKqotzCeAFBBYw0iV4SGiR5WOdkqvHa9QGDCNkAqd2uQ2CNLTBORw==
dnssec-failed.org.	3600	IN	RRSIG	DNSKEY 13 2 3600 20261112015706 20261104225206 32784 dnssec-failed.org. Plwa8hfz76oG8tgSoTRhbIG0h1cW33Eyml00H+rzzYviU7vCXY53k3EqkH5HPyLzdFH7ozHFRtIefQGcKgMJ8g==

;; TRACE
;  dnssec-failed.org A
;  . @h.root-servers.net (198.97.190.53) 6.1 ms [NOERROR qr]: referral to org.
org.		NS	d0.org.afilias-nst.org.	; 199.19.57.1 2001:500:f::1
org.		NS	a2.org.afilias-nst.info.	; 199.249.112.1 2001:500:40::1
org.		NS	b2.org.afilias-nst.org.	; 199.249.120.1 2001:500:48::1
org.		NS	v0n0.pir-ns.org.	; 199.19.56.1 2001:500:e::1
org.		NS	v0n1.pir-ns.org.	; 199.19.54.1 2001:500:c::1
org.		NS	v0n2.pir-ns.org.	; 199.19.53.1 2001:500:b::1
org.	86400	IN	DS	26974 8 2 4FEDE294C53F438A158C41D39489CD78A86BEB0D8A0AEAFF14745C0D16E1DE32
org.	86400	IN	DS	725 8 2 EB3881030D9D34BB7BC40DDC5A198E7C830804C03FB6AA982592946DEB27BEBE
;  org. @d0.org.afilias-nst.org (199.19.57.1) 11 ms [NOERROR qr]: referral to dnssec-failed.org.
dnssec-failed.org.		NS	dns102.comcast.net.	; 68.87.85.132 2001:558:1004:7:68:87:85:132
dnssec-failed.org.		NS	dns103.comcast.net.	; 68.87.76.228 2001:558:1014:c:68:87:76:228
dnssec-failed.org.		NS	dns105.comcast.net.	; 68.87.72.244 2001:558:100e:5:68:87:72:244
dnssec-failed.org.		NS	dns101.comcast.net.	; 69.252.250.103 2001:558:fe23:8:69:252:250:103
dnssec-failed.org.		NS	dns104.comcast.net.	; 68.87.68.244 2001:558:100a:5:68:87:68:244
dnssec-failed.org.	3600	IN	DS	42069 13 2 62726F6B656E20636861696E206F662074727573742073656E642068656C7021
;  dnssec-failed.org. @dns101.comcast.net (69.252.250.103) 101 ms [NOERROR qr aa]: answer
dnssec-failed.org.	300	IN	A	96.99.227.255

;; NAMESERVERS (SOA asked of each address)
;  dns101.comcast.net [parent+zone]
;    69.252.250.103                          ok                        2010102614  97 ms
;    2001:558:fe23:8:69:252:250:103          ok                        2010102614  97 ms
;  dns102.comcast.net [parent+zone]
;    68.87.85.132                            ok                        2010102614  140 ms
;    2001:558:1004:7:68:87:85:132            ok                        2010102614  155 ms
;  dns103.comcast.net [parent+zone]
;    68.87.76.228                            ok                        2010102614  164 ms
;    2001:558:1014:c:68:87:76:228            ok                        2010102614  156 ms
;  dns104.comcast.net [parent+zone]
;    68.87.68.244                            ok                        2010102614  120 ms
;    2001:558:100a:5:68:87:68:244            ok                        2010102614  110 ms
;  dns105.comcast.net [parent+zone]
;    68.87.72.244                            ok                        2010102614  127 ms
;    2001:558:100e:5:68:87:72:244            ok                        2010102614  115 ms

;; DNSSEC: signed (Cloudflare: SERVFAIL, Google: SERVFAIL)
dnssec-failed.org.	3600	IN	DS	42069 13 2 62726F6B656E20636861696E206F662074727573742073656E642068656C7021	; no matching DNSKEY
dnssec-failed.org.	3600	IN	DNSKEY	256 3 13 +q1YaNu7nKJuMoQ4oAIqg4fvrSwFb/qeEu/2x6KX+r8Rnv0eC448+PnP9KoI1IETn4W9I7ilBxWsENtLUqxRUg==	; tag 32784
dnssec-failed.org.	3600	IN	DNSKEY	257 3 13 1CcdGV2EigL5bsrPpkSvYHzyfYR1udWKZtWHU9EQXMrbtKglmUDYKKkwwajHQQ7TAMIit/vQbCrh4SPkxLbhgg==	; tag 50719

;; EMAIL
;  SPF (0/10 lookups): v=spf1 -all
;    -all
;  DMARC: none

;; HOSTS
;  dnssec-failed.org (the name looked up) SERVFAIL
;  dns101.comcast.net (nameserver)
;    69.252.250.103                          PTR dns101.comcast.net (confirmed)
;    2001:558:fe23:8:69:252:250:103          PTR dns101.comcast.net (confirmed)
;  dns102.comcast.net (nameserver)
;    68.87.85.132                            PTR dns102.comcast.net (confirmed)
;    2001:558:1004:7:68:87:85:132            PTR dns102.comcast.net (confirmed)
;  dns103.comcast.net (nameserver)
;    68.87.76.228                            PTR dns103.comcast.net (confirmed)
;    2001:558:1014:c:68:87:76:228            PTR dns103.comcast.net (confirmed)
;  dns104.comcast.net (nameserver)
;    68.87.68.244                            PTR dns104.comcast.net (confirmed)
;    2001:558:100a:5:68:87:68:244            PTR dns104.comcast.net (confirmed)
;  dns105.comcast.net (nameserver)
;    68.87.72.244                            PTR dns105.comcast.net (confirmed)
;    2001:558:100e:5:68:87:72:244            PTR dns105.comcast.net (confirmed)

;; PUBLIC RESOLVERS
;  Cloudflare A     SERVFAIL
;  Cloudflare AAAA  SERVFAIL
;  Cloudflare MX    SERVFAIL
;  Google     A     SERVFAIL
;  Google     AAAA  SERVFAIL
;  Google     MX    SERVFAIL
;  Quad9      A     timed out
;  Quad9      AAAA  timed out
;  Quad9      MX    SERVFAIL
;  OpenDNS    A     SERVFAIL
;  OpenDNS    AAAA  SERVFAIL
;  OpenDNS    MX    SERVFAIL