What it does
Zonemaster examines DNS from the root through a domain's authoritative servers and tests matters such as DNSSEC signatures, reachability and valid addresses.
Enter the DNS zone, such as example.com, rather than a host like www.example.com. Zonemaster follows delegation from the root and reports DNSSEC, reachability and configuration findings. Show options can change IPv4/IPv6 use, supply proposed nameservers for an undelegated test, or check DS records before publication in the parent. Read each severity message in context; even a clean migration test cannot detect every possible zone-data problem. Repeating identical parameters within ten minutes returns the previous result. Public instances expose the domain’s test history. Their policy says the database stores the domain, parameters and results without information linking a test to its initiating user.
Strengths
- Delegation-chain examination
- DNSSEC and server-reachability checks
Best for
- Diagnosing domain delegation and DNSSEC issues
Sources
- Zonemaster (Oct 26, 2026)
- Zonemaster FAQ (Oct 26, 2026)