DNS · Fix guide
DNSSEC is not validated
- DNSSEC
- Domain Name System Security Extensions
The resolver could not authenticate this DNS answer with a DNSSEC chain of trust.
What does this test measure?
The resolver could not authenticate this DNS answer with a DNSSEC chain of trust.
What to do next
- Ask the DNS provider whether it supports DNSSEC.
- Enable zone signing, then publish the supplied DS record at the registrar.
- Verify the DS and DNSKEY values before rotating keys.
Useful links
How to verify the fix
Query through a validating resolver and confirm the authenticated-data flag is set.
When this result may be wrong
DNSSEC is optional. A failed or stale DS record is worse than leaving DNSSEC disabled, so deployment must be coordinated carefully.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.