While cloudflare.com/ssl/encrypted-sni/#results tells me that "DNSSEC. Attackers cannot trick you into visiting a fake website by manipulating DNS responses for domains that are outside their control," this extension claims that "cloudflare.com not secure by DNSSEC. Domain www.cloudflare.com is not secure through DNSSEC. Your connection is prone to man-in-the-middle attacks."

Unfortunately we never got to choose the resolver, and now it just stopped providing accurate results altogether.

This use to work... but now no longer works.

used to display info and change but now it just always stays at NOPE doubt it's nope and 99% sure it's not me causing it.

Actualmente, esta extensión no funciona. La usé mucho tiempo y estaba contento con su funcionamiento, pero ahora mismo he tenido que buscar una alternativa.

I would give at least 4 stars, if it would use my local resolver instead of using google/cloudflare for DNS lookups.

Reason behind the downgrade:
1. it introduces a single point of failure:
if either of those sites can't answer, _ALL_ users of this extension (who have configured that site) can't use it, if it would use the local resolver and that failed it would be just the users of the local machine who experience that problem.

2. it is a privacy hazard:
a hacker needs to crack only a single (ok: two) machine(s) to get a complete log of who on this world tried to communicate with which web server....
if it would use the local configured resolver that _might_ still be a problem, depending on the configuration of said resolver, but mostly (I hope) those will contact multiple authoritative servers to walk from the root to the leaf containing the desired information and only the _last_ server will know which site I wanted to contact, but there it's irrelevant, since _that_ site knows it anyway.... (btw.: _THIS_ is the reason why I disabled this extension)

3. it can't verify local domains
according to 'dig' my own domains are DNSSEC enabled and working correctly, still your extension reports them as unsigned because there is no global glue record, as such while it is reachable from the world (via dyndns), the world doesn't see the DNSSEC information stored on my local dns-server.

Please let the user choose (a text input) his own DNS resolver(s)

Four stars for functionality, minus two because the implementation goes through Google. Yes, much the same as every other review so far - I'm actually writing this review to let you know that you don't actually need to trust any external HTTPS service to handle this!

Specifically, the Chrome version of DNSSEC/TLSA Validator, the extension you're clearly attempting to replicate, suffers from the same WebExtensions restrictions that modern Firefox does. Rather than trust an external service, however, they work around the issue through a WebExtensions feature called native messaging: a compiled binary is installed onto the system, which can do whatever it likes locally including make its own DNS queries, and then the WebExtension can ask that binary to check DNSSEC status when necessary.

Yes, it's a little bit of a hassle to install the necessary binary in the first place, since the browser won't install it automatically, but it's much more secure than trusting any external service - and it's no different to how the Chrome version of DNSSEC/TLSA Validator works right now.

I can confirm that Firefox supports this exact same approach, since I use several WebExtensions in Firefox this way (browserpass and bukubrow, specifically!). I don't know why the folks behind the DNSSEC/TLSA Validator haven't simply released a Firefox 57+ extension that uses native messaging, exactly like their existing Chrome extension, but it's definitely something you could do. :)

I'm with bsiege: I'm looking to replace CZ.NIC Labs' excellent DNSSEC/TLSA Validator. (In use since 2.2.0.3, Nov. 2016, currently 2.2.0.4 in use with Cyberfox x64 52.6.1 portable under Windows 7 and Quad9 DNS.) DNSSEC *and* TLSA validation.

Rating: five stars for proof of concept; minus three for google.

In Mozilla's quest to make its browser more "secure," it disabled the ability to run extensions to make sure it's doing so and the ones to force it to do so if needed.

I'll be revisiting this page to check on your progress. Thanks for your efforts with hopes for success.

Using fixed remote/public DNSSEC DNS Server/Resolver over unencrypted connection is NOT secure habit/procedure. And Google is known to LOG/record usage for-ever ! https://developers.google.com/speed/public-dns/privacy
Please add option for users, to specify their own local DNSSEC DNS validating servers/resolvers (like: Unbound, BIND, etc) or redirectors/resolvers (like: Stubby, GetDNS, etc) in this addon. Local DNSSEC resolvers or redirectors can run/respond on IP 127.0.0.1, 127.0.0.2, etc, Port 53.
ISP corporations can see+record/log (aka, profile) user's all DNS resolving IP data, etc usage, when DNS query/answer going over UDP/TCP unencryptedly into their or any other DNS server/resolver. If a trustworthy 3rd-Party(3P) public DNSSEC-DNS Server/Resolver service(s) is(are) used (who has publicly publicized that they absolutely do not record user's any DNS usage), then that(those) service(s) can help to maintain privacy (little bit better). When encrypted/TLS connections are used, then ISP cannot see data inside encrypted packet (but can see+record(profile) IP adrs of "from"/"source" and "to"/"destination") unless ISP also obtained required+related decryption cert+key. But tracking/recording/profiling still possible (from 3P to DNS-servers/resolvers traffic), as all DNS servers/resolvers are not yet using DNS-over-TLS, and, DNS by nature need to connect with known/established IP addresses.
When DNS Data & Content Data authenticity can be verified by using unchangeable (but updateable with newer data) records from public p2p ledger (i.e: blockchain), and content data is obtained via multiple random p2p network based multiple peer computers, then full/complete profiling will not be possible.
Unbound DNSSEC server/resolver software also supports Encrypted DNSSEC resolving (DNS-over-TLS https://tools.ietf.org/html/rfc7858 ) on Port 853 when user will use+specify+load custom cert+key in Unbound-resolver & in client (firefox/unbound/libunbound, etc). And when SOCKS5 (tunnel/proxy etc) used by firefox/user/host-computer, then Encrypted DNSSSEC resolving is very necessary.
If this addon (will be) using "libunbound", then also please add option for users to manually specify/add their own "root.key", and/or add PEM/cert for dnssec-rootkey webpage/site, and add/specify cert+key for encrypted/TLS DNS-resolving, etc.
Unbound: https://www.unbound.net/
Quad9 https://quad9.net/ DNSSEC resolving (online) service supports (Encrypted) DNS over TLS, on IP 9.9.9.9 & 2620:fe::fe , Port 853. And GetDnsApi https://getdnsapi.net/ service supports (Encrypted) DNSSEC DNS over TLS on IP 185.49.141.37 & 2a04:b900:0:100::37 , Port 853. Both Quad9 & GetDnsApi also supports unencrypted DNS over UDP/TCP on Port 53. More IP: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
The "getdns"/"Stubby" https://getdnsapi.net/ , https://github.com/getdnsapi/getdns , https://github.com/getdnsapi/stubby , etc redirectors/resolvers software can also be used (instead of Unbound/BIND server software) to forward/resolve all local DNS queries over TLS/encrypted connection.
Almost all OS have option to load Unbound (or other Full Validating DNSSEC DNS Server/Resolver, etc), either directly, or thru 3rd-party(3P) package-management software (CygWin, MacPorts, HomeBrew, etc).
Also check out the alternative DNSSEC-Validator (XUL based) firefox addon/extension https://www.dnssec-validator.cz/ which allows using custom/local/remote DNSSEC resolver/server with firefox below v57, (and dnssec-validator does not yet have a Web-Extension (W-E) based addon/extension for firefox v57+ (when i posted this message here Dec-30-2017), but their chrome extension should+can be converted to be used with firefox v57+).
DANE/TLSA is best part of DNSSEC. if this addon is already not doing this, then please also add these options: Display DANE verification related status ICONs in toolbar for HTTPS based websites which are DNSSEC signed, so that user can know/view different ICONs for different types of verification/unverification status.

Searched for a replacement of https://addons.mozilla.org/en-US/firefox/addon/dnssec-validator/ But as long it uses hardcoded Google servers and not the same as the local machine it is more dangerous than helpful (for me)