← All checks

Is DNSSEC enabled on my domain? How to check and fix it

DNSSEC medium DNS · 7 of 100 points

What it inspects

The DS record for the zone apex, then an SOA query through a validating resolver. Verdicts: PASS when a DS exists and the resolver returns an authenticated answer (AD bit). WARN when the zone is unsigned (no DS), or signed but the resolver did not validate the answer. FAIL when a DS exists but validating lookups fail with SERVFAIL while the same lookup with checking disabled succeeds: the domain is broken for validating resolvers. SKIP on a resolver timeout. This scanner trusts the resolver's validation; it does not validate itself.

Why it matters

DNSSEC lets resolvers detect forged DNS answers. A broken DNSSEC setup is worse than none: validating resolvers (including large public ones) refuse to resolve your domain at all.

How to verify by hand

# bash: DS at the parent, then look for the ad flag in the header
dig +short DS example.com
dig +dnssec SOA example.com @1.1.1.1

# PowerShell
Resolve-DnsName -Name example.com -Type DS
Resolve-DnsName -Name example.com -Type SOA -DnssecOk -Server 1.1.1.1

How to fix

Enable DNSSEC signing at your DNS provider, then add the DS record it gives you at your registrar.

  1. Turn on DNSSEC for the zone at your DNS host and copy the DS values it shows.

  2. Add the DS record at your registrar (not in your zone file):

    example.com.  IN  DS  12345 13 2 49FD46E6C4B45C55D4AC...

    If DNSSEC is currently failing, remove the DS at the registrar first to restore resolution, then fix signing.

References

Scan your domain free