dotvitals

The zone is signed but the registry has no DS record

HighConfirmeddns.dnssec.ds-missing-while-signed

What this check looks for

Your DNS host is signing the zone, but your registrar has not published the record that tells the world to check those signatures. You are paying the cost of DNSSEC and getting none of the protection.

Why it matters

Without a DS record at the registry there is no link from the internet's root of trust to your zone, so every validating resolver treats the domain as unsigned and ignores the signatures entirely. The setup looks complete in your DNS host's control panel, which is why it is so often left half-finished.

When the check passes, your report says: “The registry publishes the DS record that anchors your signatures”.

What it costs your score

When this check fails it removes 25 points from your DNSSEC score, before the status, confidence and repeat multipliers are applied. DNSSEC carries a weight of 4 in the overall score.

It shares the dnssec.chain family ceiling of 50 points: however many findings that family produces, together they cannot remove more than that from DNSSEC. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
25 points
Family cap
dnssec.chain · 50
Category
DNSSEC
Module
Dns dnssec
Fix owned by
registrar
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Publish the DS record for your key-signing key at your registrar.

Without it, no resolver checks your signatures and the signing does nothing.

  1. Take the DS record generated from your live DNSKEY — the fix builder computes it for you with SHA-256, the digest every registry accepts.

  2. Open the DNSSEC section of your registrar's control panel and add it. Some registrars ask for the DS fields (key tag, algorithm, digest type, digest); others ask for the DNSKEY itself and compute the DS for you.

  3. Wait for the registry to publish it — usually minutes, occasionally a day.

  4. Confirm a validating resolver still resolves the domain afterwards. This is the step where a wrong DS causes an outage, so do not skip it.

How to confirm it worked

  • dig +short DS ‹domain› — expect a DS record

  • delv ‹domain› A — expect "fully validated"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

‹domain› publishes DNSKEY records but the parent zone publishes no DS. RFC 4034 §5 makes the DS record the sole link between a parent and a signed child; RFC 4035 §5 says a resolver with no DS treats the child as unsecured. The DS is entered at the registrar, not at the DNS host — that split is the reason for this finding. The key to submit is the key-signing key, tag ‹key tag›.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns dnssec checkerBuild the fix

Other dns dnssec checks