Recommended Free Tools
DNSViz helps you inspect how a domain resolves and whether its DNSSEC chain of authentication is working. Its graph maps the DNS path, records, delegations, warnings and errors; it diagnoses observed DNS behaviour but does not change your registrar, DNS host or authoritative-server settings.
The web service is currently in maintenance mode: it can run a new analysis, but cannot load historical analyses or save new results to its database. If you need repeatable local analyses or saved output, the project also documents a command-line suite.
As an Amazon Associate I earn from qualifying purchases.
What DNSViz does—and what it does not do
The DNSViz project describes it as “a tool for visualizing the status of a DNS zone.” It was created to help users understand and troubleshoot DNSSEC deployment. For a domain, DNSViz can show the DNSSEC authentication chain and the resolution path through the DNS namespace, then list configuration errors it detects. DNSViz
It is an analysis tool, not a DNS host or a repair service. A warning can help you identify where to investigate, but changing a DS record, DNSKEY, zone file or nameserver configuration still requires action in the relevant registrar, DNS provider or authoritative-server environment.
#1 Best Overall
What the maintenance-mode notice means
DNSViz’s official website currently says the service is in maintenance mode and has no access to its back-end database. You can start a fresh analysis, but cannot retrieve historical analyses or save new ones to the database. That distinction matters: a new web result may help with a one-time check, but the site is not currently a history or reporting archive. Check the live site for an updated status before relying on those capabilities.
How to read a DNSViz DNSSEC graph
The graph represents zones and delegations alongside resource record sets (RRsets), DNSSEC records and validation details. A zone is grouped by its origin and labeled with the time it was last analysed. The DNSViz DNSSEC visualization guide documents the graph elements and their meanings.
Follow zones and delegation edges
Delegations connect one zone to another and indicate the state of that relationship. The guide distinguishes secure, insecure, bogus, lame and incomplete delegations. Its documented visual conventions include a solid blue edge for a secure delegation, a dashed red edge for a bogus one, and dashed yellow edges for lame or incomplete states. Treat these as cues, not a diagnosis by themselves: inspect the full graph and the associated warnings or errors before deciding what is wrong.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Inspect RRsets and DNSSEC records
RRsets appear as rounded rectangular nodes. Common examples include SOA, A, AAAA, MX and CNAME records. The graph also shows DNSSEC-specific data such as DNSKEY and DS records, signatures (RRSIG), and denial-of-existence records such as NSEC or NSEC3. Depending on the zone, it can include CDNSKEY and CDS RRsets, wildcard information, negative responses and alias relationships.
Rank #3
- Used Book in Good Condition
DNSKEY node decorations can convey details including the SEP bit, the revoke bit and whether a key is treated as a trust anchor. Trust-anchor options are implementation details: consult the current interface and documentation if you need to change them rather than assuming an old default remains appropriate.
Use warnings and errors to guide the next check
Warnings and errors identify conditions DNSViz observed while analysing the name. Read them with the graph: a visible problem at a delegation or record node can help narrow the affected part of the chain, while the complete path provides context. The result describes the analysis, not a change made to the domain, and it does not by itself establish that every resolver or network will observe identical behaviour.
Rank #4
Choose the web service or command line
| Route | Best suited to | Output and trade-off |
|---|---|---|
| DNSViz web service | A quick fresh analysis when an interactive graph is enough. | Interactive visualization; currently cannot load historical analyses or save new analyses to its database. |
dnsviz command-line suite |
Local, repeatable workflows, including testing DNS before deployment. | Can gather query results, assess them, and produce graph, text or HTML output; requires local setup and dependency management. |
The repository documents querying recursive resolvers or authoritative servers, and analysing a domain together with its ancestry. That makes the command line useful when you want to retain an input probe file or compare output across a configuration change. The exact installation route and dependencies can change, so use the current official DNSViz repository and its subcommand documentation rather than relying on an old package or version instruction.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
A practical workflow for checking a domain
- Run an initial analysis. Use the web service for a one-time graph if its current status fits your needs, or follow the repository’s current installation instructions for a local workflow.
- Trace the path. Start at the domain’s zone and follow delegations through its DNS ancestry. Note where a delegation is secure, insecure, bogus, lame or incomplete.
- Inspect records and messages. Check the relevant RRsets, DNSKEY and DS data, signatures, denial-of-existence records, and any warnings or errors associated with the path.
- Make configuration changes in the right system. If the result points to a registrar DS record, DNS host zone data or authoritative-server behaviour, correct it in that system; DNSViz does not apply the change.
- Analyse again and preserve results if needed. For repeatability, the command-line workflow can save probe results and generate text, HTML or graph output. Compare a subsequent analysis with the earlier one to see what changed.
When DNSViz is useful—and when it is not enough
- Useful for: visualising a DNSSEC chain, tracing a resolution path, locating reported configuration problems, or checking a proposed DNS change before deployment.
- Plan around the web limitation: if you need saved history or a record of prior analyses, the maintenance-mode web service does not currently provide that database function; use a local workflow if it meets your needs.
- Not a substitute for configuration access: diagnosis may identify a likely issue, but resolving it requires access to the system that controls the relevant DNS data or delegation.
- Not a guarantee about every vantage point: DNS answers can depend on the resolver or authoritative server queried. The command-line documentation’s support for querying different server types is useful when the question requires more than one view.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
