Free tool
DNSSEC checker
Free DNSSEC checker: see DS/DNSKEY records and whether Google Public DNS returns Authentic Data for your domain.
DNSSEC adds cryptographic signatures to DNS data. This checker looks up DS and DNSKEY and reports whether Google Public DNS set the Authentic Data flag for your name.
Reading the result
DS at the parent and DNSKEY at the child are the usual signals that DNSSEC is published. Authentic Data (AD) on an A lookup means the resolver validated the chain for that response. Missing DS often means the zone is unsigned or the DS was never uploaded at the registrar.
When AD is false but records exist
Partial rollouts, broken chains, or resolvers that do not validate can produce this pattern. Fix DS/DNSKEY mismatches with your DNS host, then re-check after TTL.