DigDeep — Client-Side DNSSEC Chain-of-Trust Visualizer & DoH Wire Inspector

Analyze DNS delegations, DS digests, DNSKEY rollovers, RRSIG cryptographic signatures, NSEC/NSEC3 negative proofs, and raw RFC 8484 DNS-over-HTTPS wire packets directly in your browser with zero backend servers.

Key Capabilities

  • Browser WebCrypto Verification: Validates RFC 4034, RFC 4035, and RFC 5155 chains from IANA Root KSK trust anchors using SubtleCrypto.
  • Multi-Resolver DoH Comparison: Query Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, DNS.SB, DNS4EU, or custom DoH resolvers with side-by-side CD=1 / CD=0 and RFC 8914 Extended DNS Error (EDE) inspection.
  • Interactive Graph & Snapshot Diffing: Inspect cross-zone CNAMEs, missing SEP keys, time-travel RRSIG expiration windows, and export standalone SVG or PNG diagrams.