Publish the DS record at your registrar

Why it matters

Your zone is signed, but the registry has no DS record linking it to the parent zone, so validating resolvers treat the signatures as unverifiable. DNSSEC gives you no protection until the DS record is added.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Get the DS record data from your DNS provider (key tag, algorithm, digest type and digest), or compute it from the zone's key signing key (the DNSKEY with flag 257).
2. Check that the zone is correctly signed and every nameserver serves the same signed data before you publish the DS record. A wrong DS record breaks resolution for validating resolvers.
3. At your registrar, find the DNSSEC or DS record settings and add the record. Prefer digest type 2 (SHA-256).
4. Keep the old setup until you have confirmed it works. To roll back, remove the DS record at the registrar and wait for its TTL.
5. Confirm with a validating resolver. A good answer has the ad flag.

dig +dnssec DNSKEY example.com
dig @1.1.1.1 A example.com +dnssec | grep -E "flags|status"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Make your DNSSEC signatures something resolvers can validate
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Move DNSSEC to a stronger signing algorithm
• Add a SHA-256 DS record