DNSSEC enabledWhat it checks and how to fix it

What it checks

Asks Google Public DNS for the domain's DNSKEY records. Passes when DNSKEY records are published, and fails when there are none, when the domain does not exist, or when the resolver answers SERVFAIL, which usually means DNSSEC is broken (for example a DS record at the registrar that no longer matches the zone's keys).

Why it matters

DNSSEC signs your DNS records so resolvers can detect forged answers. Without it, an attacker who poisons a resolver's cache can send your visitors and your incoming mail to their own servers. A broken DNSSEC setup is worse than none: validating resolvers then refuse to resolve the domain at all.

How to fix it

DNSSEC takes two steps: turn on zone signing at your DNS provider, then publish the DS record it gives you at your registrar.

• Cloudflare: DNS → Settings → Enable DNSSEC, then copy the DS record into your registrar (this is automatic with Cloudflare Registrar).
• AWS Route 53: enable DNSSEC signing on the hosted zone (it creates a key-signing key in KMS), then add the DS record at the registrar.
• Other providers: look for a "DNSSEC" toggle in the zone settings; most registrars accept the DS record in their domain settings.

A DS record looks like this:

example.com.  3600  IN  DS  2371 13 2 1F987CC6583E92DF0890718C42...

Check the result:

dig +dnssec +short DNSKEY example.com
dig +short DS example.com
delv example.com

When moving the zone to another DNS provider, remove the DS record at the registrar first and wait for its TTL to expire, or the domain stops resolving for validating resolvers.