DNSSEC check
What is checked
DS
The DS records the parent zone publishes, and which DNSKEY each one matches (the digest is recomputed here).
DNSKEY
Key signing (KSK) and zone signing (ZSK) keys: algorithm, size and key tag.
RRSIG
Signatures over the DNSKEY, SOA and A records: validity period, expiry warnings and cryptographic verification.
AD flag
Whether Cloudflare, Google and Quad9 validate the name (AD set) or fail it (SERVFAIL).
From the command line
curl 'https://dns.tools.midgard.com.hr/json/?check=dnssec&name=example.com'Returns {"name":…,"zone":…,"status":"ok|warn|bad|info","summary":…,"issues":[…],"ds":[…],"keys":[…],"signatures":[…],"validators":[…]}.