Move DNSSEC to a stronger signing algorithm on Cloudflare

Why it matters

The zone is signed with an outdated algorithm (RSA/SHA-1, DSA, GOST or MD5), which is weak and which resolvers are phasing out. Resolvers that reject it will treat your domain as unsigned or fail.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Cloudflare signs only with algorithm 13 (ECDSA P-256). If the finding names an older algorithm, another signer adds those keys (for example a second DNS provider in a multi-provider setup).
2. Change the algorithm at that signer, using the order from the generic entry. Sign with both algorithms, add the new DS, remove the old DS and wait for its TTL, and only then remove the old keys.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Make your DNSSEC signatures something resolvers can validate
• Publish the DS record at your registrar
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Add a SHA-256 DS record