DNSSEC جانچ
ہم بالائی زون میں DS ریکارڈز، زون کا DNSKEY مجموعہ اور اس کے دستخط پوچھتے ہیں، اور توثیق کرنے والے ریزالور سے پوچھتے ہیں کہ جواب درست ہے یا نہیں۔
دستخط شدہ نہیں
u.ae
- ریزالور کی توثیق (AD فلیگ)
- جانچ نہیں ہوئی
DS ریکارڈز (بالائی زون میں)
کچھ شائع نہیں
DNSKEY ریکارڈز (زون میں)
کچھ شائع نہیں
یہ متن ابھی اردو میں دستیاب نہیں۔ ترجمہ شائع ہونے تک اسے انگریزی میں دکھایا جاتا ہے۔
DNSSEC lets a resolver verify that a DNS answer really comes from the zone’s owner. It works as a chain of trust: the parent zone (for example .com) publishes a DS record that fingerprints the zone’s key-signing key; the zone publishes its keys as DNSKEY records and signs its data with RRSIG records; a validating resolver follows the chain down from the root and sets the AD flag on answers it could verify.
This check queries the DS records at the parent, the DNSKEY set and its signatures, and asks our resolver whether the answer validated. It also checks that a DS record’s key tag matches a key in the zone, the most common thing to break when keys are rolled or a domain moves to a new DNS host.
The .ae zone itself is not signed today: the root zone holds no DS record for it (checked October 2026), so no name under .ae can be validated, whatever its owner does. .com, .org and most other large top-level domains are signed. An unsigned domain is not broken; it is simply not protected against forged answers.
اکثر پوچھے جانے والے سوالات
What does 'signed but not validating' mean?
The parent publishes DS records, but the resolver did not accept the zone's signatures. Validating resolvers then answer SERVFAIL, so the domain can disappear for users of those resolvers. A common cause is a DS record left behind after moving to a DNS host with different keys.
Do I need DNSSEC?
It protects against forged DNS answers (cache poisoning) and is required by some security mechanisms such as DANE. Your DNS host and registrar must both support it.
Why is the result for www.example.com about example.com?
DNSSEC is configured per zone. A host name inside a zone is covered by that zone's keys, so the check reports on the zone that contains the name.