Independently inspect a DNSSEC chain
Verify actual signed A/AAAA/MX/TXT records and parent DS→DNSKEY chains independently with WebCrypto and dated IANA root anchors.
- Named network services
- Run explicit query
- Observed result
Verify actual signed A/AAAA/MX/TXT records and parent DS→DNSKEY chains independently with WebCrypto and dated IANA root anchors. AD is only a separate resolver claim. Unsupported algorithms, missing or negative/wildcard proofs remain UNKNOWN.
No result yet
Profile and limits
15s + ≤250ms cleanup wait; query;≤20 subqueries/≤64 cryptographic operations;2MiB received;65535B DNS packet/256 records/16 compression jumps;RDAP256KiB/depth24;TLS256KiB/8×64KiB certificates;2MiB output. Unsupported/missing proofs stay unknown; no automatic retries.
How to use
- Enter an ASCII public domain (Punycode for IDNs) or public IP; select the service/type.
- Review the named recipients and privacy policies, then explicitly consent and run.
- Inspect the timestamped fields/unknown states. Save reports locally if needed. Editing or Cancel terminates the query; Reset clears local state.
How to use
- 1. Public domain
Enter an ASCII public domain (Punycode for IDNs) or public IP; select the service/type.
- 2. Run explicit query
Review the named recipients and privacy policies, then explicitly consent and run.
- 3. Observed result
Inspect the timestamped fields/unknown states. Save reports locally if needed. Editing or Cancel terminates the query; Reset clears local state.
Profile and limits
Provider privacy policies
Refentra Edge sends the domain/IP to the displayed services only on Run. Providers receive the edge address; no visitor-IP/ECS forwarding. Google temporary logs24–48h (abuse exceptions), Cloudflare limited logs≤25h plus published sampled/aggregate exceptions. Registry/RIPE policies also apply. No zero-retention promise.
Profile and limits
15s + ≤250ms cleanup wait; query;≤20 subqueries/≤64 cryptographic operations;2MiB received;65535B DNS packet/256 records/16 compression jumps;RDAP256KiB/depth24;TLS256KiB/8×64KiB certificates;2MiB output. Unsupported/missing proofs stay unknown; no automatic retries.
Observed result
Verify actual signed A/AAAA/MX/TXT records and parent DS→DNSKEY chains independently with WebCrypto and dated IANA root anchors. AD is only a separate resolver claim. Unsupported algorithms, missing or negative/wildcard proofs remain UNKNOWN.