A DNSSEC signature has expired
What this check looks for
One of your zone's signatures is out of date. Validating resolvers treat an expired signature as a forgery, so they refuse to answer for your domain at all.
Why it matters
Signature expiry is a scheduled outage nobody scheduled. Unlike a certificate, it takes effect the moment the clock passes it, with no browser warning and no grace period — the domain simply stops resolving for a large part of the internet.
When the check passes, your report says: “Every signature in the zone is currently valid”.
What it costs your score
When this check fails it removes 50 points from your DNSSEC score, before the status, confidence and repeat multipliers are applied. DNSSEC carries a weight of 4 in the overall score.
It shares the dnssec.signatures family ceiling of 55 points: however many findings that family produces, together they cannot remove more than that from DNSSEC. One underlying problem showing up in several places is still one problem.
- Severity
- critical
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 50 points
- Family cap
- dnssec.signatures · 55
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Re-sign the zone immediately, and set up monitoring for signature expiry.
An expired signature makes the domain unresolvable for every validating resolver.
Re-sign the zone at your DNS host and confirm new RRSIG records with a future expiration appear.
Check the signer's clock and its scheduled re-signing job — an expiry means the automation stopped, and it will stop again.
If you cannot re-sign quickly, removing the DS at the registrar restores resolution as an emergency measure; the domain is then unsigned.
Add expiry monitoring so the next one is caught days ahead rather than by an outage.
How to confirm it worked
dig +dnssec SOA ‹domain› — check the RRSIG expiration is in the future
delv ‹domain› A — expect "fully validated"
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These signatures are outside their validity window: ‹signature list›. RFC 4034 §3.1.5 defines the inception and expiration fields, and RFC 4035 §5.3.1 requires a validator to reject a signature outside them. A signature that is not yet valid produces the same failure and usually means a clock is wrong on the signing machine. Re-signing is normally automatic; when it stops, it is because the signer crashed, the keys became unavailable, or a manual signing process was forgotten.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- The zone's record names can be enumerated
- NSEC3 is configured with extra hash iterations
- NSEC3 opt-out weakens proof for unsigned subdomains
- DNSSEC could not be checked
- A DNSSEC signature expires within seven days
- The zone publishes keys but no signatures