A DNSSEC signature expires within seven days
What this check looks for
One of your signatures is close to its expiry date. If whatever normally renews it has stopped, your domain will become unresolvable for a large part of the internet when the date passes.
Why it matters
Signatures are normally renewed automatically well before expiry, so one getting close is itself the signal that the automation has stopped. Acting now is a five-minute job; acting after the date is an outage.
When the check passes, your report says: “Signatures are renewed well before they expire”.
What it costs your score
When this check fails it removes 10 points from your DNSSEC score, before the status, confidence and repeat multipliers are applied. DNSSEC carries a weight of 4 in the overall score.
It shares the dnssec.signatures family ceiling of 55 points: however many findings that family produces, together they cannot remove more than that from DNSSEC. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 10 points
- Family cap
- dnssec.signatures · 55
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Confirm automatic re-signing is running, and re-sign now if it is not.
A signature approaching expiry means the process that renews it has probably stopped.
Check when the zone was last re-signed at your DNS host.
Trigger a re-sign and confirm the expiration date moves out.
If re-signing is manual, move it to a scheduled job — this failure mode will recur otherwise.
How to confirm it worked
dig +dnssec SOA ‹domain› — check the RRSIG expiration has moved further out
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These signatures expire within ‹days› days: ‹signature list›. RFC 6781 §4.4.2 recommends re-signing well inside the validity period precisely so that a failure of the signer is visible before it becomes an outage. A healthy zone re-signs on a schedule and never reaches this window.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- The zone's record names can be enumerated
- NSEC3 is configured with extra hash iterations
- NSEC3 opt-out weakens proof for unsigned subdomains
- DNSSEC could not be checked
- A DNSSEC signature has expired
- The zone publishes keys but no signatures