DNSSEC could not be checked
Updated
What this check looks for
We could not read your zone's signing records, so none of the DNSSEC checks ran. This says nothing about whether your domain is signed — only that we could not look.
Why it matters
An empty DNSSEC panel and a clean one must never look the same. This finding is what keeps them distinguishable.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
‹reason›
Checking DNSSEC means asking your zone’s own nameservers for its keys and signatures directly, rather than reading what a public resolver happens to have cached. This scan could not ask them, so whether your zone is signed, and whether its signatures chain up to the parent, is unknown here.
Nothing in this section is assumed to pass in the meantime. A zone with a broken chain — the failure that makes a domain unreachable for every validating resolver — would look exactly like this. Run the scan again; if it keeps saying this, the shortfall is ours and not your zone’s.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.