Yes — it comes from the source named on this page and is refreshed on a schedule.

No. This source is fully key-less.

Yes, and it runs entirely in your browser.

Does an unsigned domain mean it is insecure?

No. DNSSEC is optional and many domains do not use it. The result only says that the DNS answer for that name has no cryptographic proof attached.

Why is a broken domain used as a test?

Because a resolver that validates must refuse it. If it loads anyway, that resolver is not checking signatures.

Does DNSSEC encrypt my traffic?

No. DNSSEC responses are authenticated but not encrypted. Encrypting DNS lookups is a separate feature, which is what DNS-over-HTTPS does.

Does DNSSEC Work Screensaver

The Does DNSSEC Work screensaver shows live DNSSEC validation resolved in your own browser over DNS-over-HTTPS, key-less. It’s free, runs in your browser, and ESC exits.

How the Does DNSSEC Work screensaver works

The saver reads the source described above and draws it on a canvas — no account, no tracking.

Live DNSSEC validation resolved in your own browser over DNS-over-HTTPS, key-less. Signed domains come back authenticated, unsigned ones simply do not, and dnssec-failed.org must refuse to resolve at all — if it ever answers, validation is off.

It refreshes on a schedule, so what you see stays current.

Colours and any options can be changed in settings; nothing is stored beyond your own browser.

How DNSSEC validation is checked

Ordinary DNS answers can be forged, so a network attacker could in principle send you to the wrong address. DNSSEC adds digital signatures: a domain publishes signed records, and its parent zone holds a DS record containing a digest of the child’s key-signing key. Validation follows this chain from a trust anchor, usually the DNS root, down to the domain; DNSSEC was first deployed at the root on 15 July 2010.

This saver asks a public resolver over DNS-over-HTTPS and reads the AD (Authenticated Data) bit, which is a recursive resolver’s indication that it validated the signatures for the answer. A domain signed correctly comes back authenticated. One that is not signed resolves normally but without the flag, which is not an error. The control case is dnssec-failed.org, whose signatures are deliberately broken: a validating resolver must return a failure for it, and if it resolves normally then validation is not being enforced.

There are limits. The flag only tells you the resolver checked the chain, and it is a hint you rely on only as far as you trust that resolver and your path to it. An unsigned result is not a sign of a problem with the site. The result depends on the resolver used, not on your own device.

A worked example

Settings & tips

Accent and Background recolour the display.
Every value on screen comes from the live source — nothing is simulated.
Press ESC to leave fullscreen.

Frequently asked questions

Is this real data?: Yes — it comes from the source named on this page and is refreshed on a schedule.
Is a key needed?: No. This source is fully key-less.
Is it free?: Yes, and it runs entirely in your browser.
Does an unsigned domain mean it is insecure?: No. DNSSEC is optional and many domains do not use it. The result only says that the DNS answer for that name has no cryptographic proof attached.
Why is a broken domain used as a test?: Because a resolver that validates must refuse it. If it loads anyway, that resolver is not checking signatures.
Does DNSSEC encrypt my traffic?: No. DNSSEC responses are authenticated but not encrypted. Encrypting DNS lookups is a separate feature, which is what DNS-over-HTTPS does.

← All Security & Privacy screensavers