DNSSEC checker
DS, DNSKEY and the validation flag.
The lookup goes from your browser straight to a public service. We never see the domain.
What this checks
DNSSEC signs DNS answers so a resolver can tell a real answer from a forged one. This tool looks up the domain's DS record (published at the registrar, pointing to the signing key) and its DNSKEY record (published in the domain's own DNS), then checks whether a resolver actually validated the chain between them.
What to look for
The AD flag is the part that matters: it is set by the resolver only when the signature chain checked out. A DS record with no AD flag means the chain is broken somewhere, which is worse than no DNSSEC at all — it can make the domain unreachable for resolvers that enforce validation.
Most domains have none of this
No DS and no DNSKEY simply means DNSSEC was never turned on, which is still the common case. It is not, by itself, a sign of a problem.