Repair broken DNSSEC so validating resolvers can resolve the domain
Why it matters
The domain publishes DNSSEC data that fails validation, so resolvers that check it (many ISPs and public resolvers) refuse to answer and the domain looks down to those users. It is typically caused by a DS record that no longer matches the keys, or expired signatures.
Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.
The fix
- Treat this as an outage for part of your audience and act first on restoring resolution.
- Diagnose with DNSViz or the dig commands below. The usual causes are a DS record at the registrar that no longer matches the zone's key after a provider move or key change, signatures that expired because signing stopped, and one nameserver serving an unsigned or stale copy.
- Fastest safe recovery when you cannot fix signing quickly. Remove the DS record at the registrar, wait for the DS record's TTL to run out (check it with dig, it is often between one hour and one day) so resolvers stop expecting signatures, then fix the zone and add the DS record again.
- If the cause is a mismatched DS, replace it with the DS your DNS provider now shows, instead of removing it. If signatures expired, make your provider or signer re-sign the zone and restore automatic re-signing.
- Confirm with a validating resolver that the answer is authenticated, then check with DNSViz that the chain is clean.
bash
# a validating resolver returns SERVFAIL for a broken chain dig @1.1.1.1 A example.com # the same query with checking disabled succeeds if the problem is DNSSEC dig @1.1.1.1 +cd A example.com dig +dnssec DS example.com dig +dnssec DNSKEY example.com
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.