The zone publishes keys but no signatures
What this check looks for
Your zone has DNSSEC keys but the records themselves are not signed. Any resolver that trusts your keys will refuse every answer, because there is nothing for it to check.
Why it matters
Keys without signatures is the worst of both worlds: the zone advertises that it is protected and then fails to provide the proof, so validating resolvers reject it outright rather than falling back to treating it as unsigned.
When the check passes, your report says: “Every record set in the zone carries a signature”.
What it costs your score
When this check fails it removes 30 points from your DNSSEC score, before the status, confidence and repeat multipliers are applied. DNSSEC carries a weight of 4 in the overall score.
It shares the dnssec.signatures family ceiling of 55 points: however many findings that family produces, together they cannot remove more than that from DNSSEC. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 30 points
- Family cap
- dnssec.signatures · 55
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Re-sign the zone, or remove the keys and the DS if you no longer want it signed.
Keys with no signatures make validating resolvers reject the domain rather than ignore DNSSEC.
Check the signer on your DNS host: re-sign the zone and confirm RRSIG records appear.
If signing was abandoned deliberately, remove the DS at the registrar first, wait for the DS TTL, then remove the DNSKEY records.
Confirm with a validating resolver before considering it done.
How to confirm it worked
dig +dnssec SOA ‹domain› — expect an RRSIG alongside the SOA
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
DNSKEY records exist at ‹domain› but no RRSIG record was returned for the SOA or the DNSKEY set. RFC 4035 §2.2 requires every authoritative RRset in a signed zone to be covered by an RRSIG. This normally means signing was enabled and then failed, or the signer stopped and the zone was reloaded from an unsigned source while the keys remained.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- The zone's record names can be enumerated
- NSEC3 is configured with extra hash iterations
- NSEC3 opt-out weakens proof for unsigned subdomains
- DNSSEC could not be checked
- A DNSSEC signature has expired
- A DNSSEC signature expires within seven days