How to Trace DNS Queries and Validate DNSSEC Records in Linux Using delv

Debugging Domain Name System (DNS) configurations in Linux has traditionally relied on utilities such as dig, nslookup, or host. While these legacy tools are excellent for basic address resolution and testing authoritative name servers, they do not perform full client-side DNSSEC (DNS Security Extensions) cryptographic validation. When troubleshooting DNS spoofing protections, signed resource records, or broken trust anchors, administrators need a tool built specifically to validate the cryptographic chain of trust.

The delv (Domain Entity Lookup & Validation) command-line utility, maintained by the Internet Systems Consortium (ISC) alongside BIND 9, is designed specifically for this purpose. Unlike dig +dnssec, which simply queries DNSSEC records and asks the upstream resolver to validate them, delv contains its own internal validating resolver. It traces the cryptographic chain from root trust anchors down to the target hostname, independently verifying every digital signature. In this guide, we explore how to install and use delv in Linux to inspect and troubleshoot DNSSEC validation.

Why Use delv Instead of dig?

Understanding the distinction between delv and dig is crucial for network engineers and system administrators:

• Independent Resolver Engine: dig asks your local upstream DNS server (e.g. 8.8.8.8 or your router) to perform validation and looks for the ad (Authenticated Data) flag. delv independently builds the validation graph locally using built-in root keys.
• Iterative Signature Checking: delv inspects RRSIG (Resource Record Signature), DNSKEY, and DS (Delegation Signer) records across each parent-child zone boundary (from root . to TLD .com down to the domain).
• Clear Cryptographic Diagnostics: If a signature has expired, uses an unsupported algorithm, or fails hash verification, delv outputs the exact failure point in plain language.

Installing delv on Linux Distributions

The delv binary is packaged alongside the standard BIND utilities. You can install it on your distribution using the following commands:

Ubuntu, Debian, and Linux Mint:

sudo apt update
sudo apt install bind9-dnsutils

RHEL, CentOS, Rocky Linux, and Fedora:

sudo dnf install bind-utils

Arch Linux:

sudo pacman -S bind

Once installed, verify the binary is accessible by checking its version:

delv -v

How to Validate a Domain with delv

To perform basic DNSSEC resolution and signature validation for a domain, simply run delv followed by the hostname:

delv digitash.com

If the domain has valid DNSSEC signing in place, delv will resolve the A record and display a validation status line:

; fully validated
digitash.com.        300 IN  A   104.21.54.120
digitash.com.        300 IN  A   172.67.182.235
digitash.com.        300 IN  RRSIG   A 13 2 300 20261110000000 20261103000000 34521 digitash.com. [signature_data]

Notice the comment line reading ; fully validated. This indicates that every cryptographic key and digital signature from the ICANN root zone down to the domain’s individual A records was successfully proven authentic.

Understanding delv Validation States

When querying different domains, delv will report one of four primary cryptographic states in its preamble:

• fully validated: The zone is signed, the delegation signer (DS) record is published in the parent zone, and all resource record signatures (RRSIG) match valid DNSKEYs.
• unsigned: The domain is not configured with DNSSEC. The parent zone has proven via an authenticated NSEC/NSEC3 record that no DS record exists for this child domain.
• insecure: Similar to unsigned; DNSSEC cannot be validated because an ancestor zone does not support DNSSEC or delegates without proof.
• resolution failed / validation failure: A critical security error. Either a signature has expired, the DS hash does not match the active DNSKEY, or packets were altered in transit.

How to Trace the Full Cryptographic Chain of Trust

To see every step delv takes to verify keys, add the +vtrace (verbose trace) flag:

delv cloudflare.com +vtrace

This command outputs an informative visual trace showing:

1. Fetching the root . DNSKEY and verifying against the built-in trust anchor.
2. Querying the .com TLD authoritative servers for the delegation signer (DS) record.
3. Validating the .com DNSKEY against the root DS signature.
4. Fetching the domain’s own DNSKEY and matching its fingerprint against the TLD’s DS record.
5. Validating the domain’s A record against its RRSIG signature.

Testing Query Against a Specific DNS Resolver

By default, delv reads your local system resolvers listed in /etc/resolv.conf. To test against an external public DNS server directly (such as Quad9 or Cloudflare DNS), prefix the server address with @:

delv @9.9.9.9 example.com A

You can also query specific record types such as MX, TXT, or AAAA:

delv @1.1.1.1 example.com MX +vtrace

Bypassing Validation for Comparison

If you suspect a DNS issue is purely related to a broken DNSSEC signature while the underlying records remain intact, you can disable signature validation using the +cd (Checking Disabled) flag:

delv example.com +cd

If the query succeeds with +cd but fails with standard delv, you have definitive proof that DNSSEC misconfiguration (such as an expired key rollover or mismatched DS record at the registrar) is breaking resolution.