dnssec-name-and-shame.com

Look at a domain and check for Domain Name System Security Extensions (DNSSEC) records. Naming and shaming included!

Initially developed during The Next Web's Kings of Code Hack Battle 2014 in Amsterdam, The Netherlands. Decommissioned during 2026.

Website decommissioned

After 12+ years online, it's time to wind down operations during 2026. Hopefully all the naming and shaming inspired someone to implement DNSSEC for their own domain. Thanks to everyone involved!

Internet Archive

The kind folks at Internet Archive have visited dnssec-name-and-shame.com 100+ times between 2014 and 2026. They also captured some domain pages (although often without the dynamic results), such as for dnssec-name-and-shame.com itself.

Notes

This implementation only checks a domain for signed A, AAAA, CNAME, MX and SOA records. You might want to try another tool for more extensive DNSSEC tests and analysis.
Lookups are cached in getdns' context for the duration of the server's uptime. DNS record TTL should also be in effect.
Source code, project page.

Requirements

getdns, see getdnsapi.net.
node.js and Node Package Manager npm (NPM).
MongoDB.
Bower.

Getting started

Make sure getdns is installed properly, including unbound's root anchor. If the root anchor isn't set up properly, all DNS lookups will be labeled insecure.
Make sure mongodb is running.
- DNAS is currently not compatible with the most recent mongodb version.
- Long-term on-disk storage of the database is not required, but can be useful.

# Clone the repository
git clone --recursive https://github.com/joelpurra/node-dnssec-name-shame.git node-dnssec-name-shame
cd node-dnssec-name-shame

# Install dependencies
npm install
./node_modules/.bin/bower install

# Start the server. Note that logging is in bunyan's json format.
npm start

Containerization of the mongo image is recommended, for example using podman.

# NOTE: simple containerized mongodb; this is not a production-ready setup, with volumes for storage etcetera.
podman container run --rm --init --publish '127.0.0.1:27017:27017/tcp' --name 'mongo-dnas' docker.io/library/mongo:4.4

Browse to your local test site, https://localhost:5000/.

Development

# Start the server in debugging mode
npm run debug

# Test the code
npm test --silent

Optionally debug the server, possibly using Chrome DevTools for Node.js.

Todo

☐ Fetch Alexa's top 25 (or more) sites dynamically.
☐ Create pretty-pretty slide show style animations for the listed example domains?
☑ Modify links to the external sites to open in new window, and add link to /domain/example.com so content can be discovered.
☑ Tweet the results.
☑ Add sounds for pass and fail.
☑ Create a small API.
☑ Download Google Fonts and serve locally: google-font-download "Quando" "Pacifico" "'Open Sans'".

Thanks

Versign Labs.
NLnet Labs, with special thanks to Willem Toorop (@wtoorop) for all the help with the DNAS server(s).
Anne-Marie Eklund Löwinder, DNSSEC pioneer and Internet Hall of Fame inductee, for the photo made specially for this site.
Photo of Anne-Marie Eklund Löwinder by Per-Ola Mjömark, licensed under CC BY 4.0.
Fail sound buzzer2.wav by hypocore, licensed under CC0 1.0.
Success sound success.wav by grunz, licensed under CC BY 3.0.

License

When using node-dnssec-name-shame, comply to the GNU Affero General Public License 3.0 (AGPL-3.0). Please see the LICENSE file for details.