DNSSEC Explained: Verify the Chain of Trust Yourself

Check DS, DNSKEY and RRSIG records with curl, recompute a DS digest in Python, and read SERVFAIL errors to see if DNSSEC actually protects your domain.