webzod
account

Find out why resolvers disagree about your DNSSEC

dns.dnssec.resolver_mismatch · effort: about an hour

Why it matters

One validating resolver accepts your DNSSEC data and another rejects it, so some visitors may fail to resolve the domain. It is often a temporary state during a change, or a difference between nameservers.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Wait a short while and check again, because caches and a recent key or DS change can cause a temporary mismatch.
  2. Query each of your nameservers directly with the command below and make sure they return the same DNSKEY records and valid signatures that have not expired.
  3. Check the zone's signing algorithm. A resolver that does not support it treats the zone as unsigned instead of rejecting it (RFC 4035 section 5.2), so an algorithm problem alone rarely causes a failure. Algorithm 13 (ECDSA P-256) or 8 (RSA/SHA-256) is widely supported.
  4. Run DNSViz on the domain to find chain errors, and fix them with your DNS provider.
  5. If a problem persists and users are affected, use the recovery steps from the broken DNSSEC finding.
bash 
for ns in $(dig NS example.com +short); do
  echo "$ns"; dig +norec +dnssec @"$ns" DNSKEY example.com +short | wc -l
done
dig @1.1.1.1 A example.com | grep -E "status|flags"
dig @9.9.9.9 A example.com | grep -E "status|flags"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.