DNSViz

DNSViz is a focused DNSSEC diagnostic suite for administrators, DNS engineers, and anyone responsible for domain delegations. It suits readers who need to follow a trust chain or investigate a validation failure rather than simply check whether a site resolves. The web interface is convenient for one-off inspections, while local command-line output is the better foundation for repeatable work.

Overview

DNSViz maps a zone's DNSSEC authentication chain and resolution path, then points out configuration errors along the route. It classifies DNS data as secure, bogus, or insecure according to whether a chain of trust can be established from a trust anchor. That turns a vague DNSSEC failure into a traceable problem involving a delegation, record set, signature, or response.

The web service is in maintenance mode. It can run fresh analyses, but it cannot load historical analyses or save new results to its database. That makes it useful for immediate diagnosis, not for maintaining a long-term web archive of configuration changes. The open-source project is GPL-2.0, and Verisign Labs sponsors ongoing development.

Key features

Detailed DNSSEC graph

The visualization includes zones and delegations, resource record sets, negative responses, DNSKEY and DS records, NSEC/NSEC3, signatures, CDNSKEY/CDS, wildcards, node status, warnings, and errors. This level of detail helps an operator locate the exact point where authentication succeeds or breaks instead of reducing the result to pass or fail.

The web view uses the root-zone KSK as its default exclusive trust anchor. The options field can instead accept arbitrary DNSKEY trust anchors, which is useful when checking a private or staged trust arrangement rather than only the public DNS hierarchy.

Command-line analysis

The suite provides probe, grok, graph, print, and query subcommands. Probe accepts one or more domain names, queries recursive resolvers by default, or authoritative servers when requested, and serializes the findings as JSON. Graph can turn those results into an image, DOT graph, or HTML file; the other commands support querying, assessment, and text output. This makes local retention and scripted review practical despite the web service's database limitation.

Pre-deployment checks

DNSViz documents testing for zones and proposed delegation, glue, and DS-record changes before deployment. That gives operators a way to inspect planned DNSSEC changes before they affect production validation.

Pricing

DNSViz is free and open source. The DNSViz plan costs nothing, with no paid tier or free trial. The web analysis restriction still applies: historical results cannot be loaded and new results cannot be saved to its database. There are no seat or quota terms stated, so teams needing controlled retention should use the command-line tools and keep their own output.

Platforms

DNSViz is offered as a web service and API, with local support for Linux, macOS, FreeBSD, and other Python-supported environments. Packages are documented for Debian, Ubuntu, Fedora, Gentoo, FreeBSD, EPEL, and specified RHEL and CentOS versions; macOS installation is documented through Homebrew or MacPorts. A Docker container is available for running the commands in an isolated deployment.

Installation may require Python, dnspython, pygraphviz, and cryptography, plus system components such as Graphviz and OpenSSL. Optional GOST DNSSEC algorithm and digest support requires the OpenSSL GOST Engine and M2Crypto, so specialist deployments should account for those additional dependencies.

Who it's for

Choose DNSViz if you administer DNSSEC-enabled zones, troubleshoot delegations, or need to verify proposed glue and DS changes. It is particularly strong for engineers who want both an explanatory visual graph and machine-readable local results. It is less suitable as a hosted monitoring history or a compliance product: the web database does not retain analyses, and the project makes no security certification or compliance claim.

Pros and cons

Pros

• Traceable DNSSEC diagnosis: secure, bogus, and insecure classifications are tied to a visible chain of trust, warnings, and errors.
• Broad protocol coverage: the graph covers DNSKEY, DS, NSEC/NSEC3, signatures, negative responses, wildcards, and CDNSKEY/CDS.
• Scriptable local workflow: JSON probe results and image, DOT, or HTML graph output support repeatable analysis and retention outside the web service.
• Useful before changes go live: documented pre-deployment checks cover zones, delegations, glue, and DS records.
• No license cost: the GPL-2.0 project and free plan allow use without a subscription.

Cons

• No web history: maintenance mode prevents loading historical analyses or saving new ones to the database.
• Setup can be technical: Python packages and system dependencies such as Graphviz and OpenSSL may need separate installation.
• Not a compliance service: no security certification or compliance claim is provided.

Alternatives

nPerf is the better pick for general speed, latency, streaming, and navigation tests across phones and computers rather than DNSSEC-chain analysis.

PingPlotter fits readers who need connection monitoring and history; its free plan allows one connection and 10 minutes of monitoring history.

SoftPerfect Bandwidth Manager is aimed at controlling traffic with rules, usage reports, and live monitoring, not validating DNSSEC.

NetSpot is the more relevant choice for Wi-Fi surveying and wireless diagnostics on supported desktop and mobile platforms.

Globalping is a broader open-source network-testing option when distributed probes are more important than DNSSEC graph detail.

Nmap is preferable for general network discovery and security scanning rather than DNS trust-chain troubleshooting.

Buddi is budgeting software and therefore serves a completely different need.

DNSViz Toolkit is the closest named alternative for a free DNSViz-oriented toolkit with web and self-hosted platforms.

Verdict

DNSViz is a strong choice for DNS administrators and engineers who need to see exactly how DNSSEC validation travels through a zone and to preserve results locally through command-line output. Choose it for technical diagnosis and pre-deployment checking. Look elsewhere if you need hosted historical records, ongoing monitoring, or a certified compliance platform.