The domain is not signed with DNSSEC
What this check looks for
Nothing proves that the DNS answers people receive for your domain are the ones you published. A resolver that is fed a forged answer has no way to detect it.
Why it matters
Without DNSSEC, an attacker who can influence a resolver's cache can point your domain anywhere — including at a server that will pass a certificate check, because certificate issuance itself relies on DNS. Signing closes that door for every validating resolver, which today is most of them.
When the check passes, your report says: “DNS answers for this domain are signed and can be verified”.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Enable DNSSEC at your DNS host, then publish the DS record at your registrar.
It is the only mechanism that lets a resolver detect a forged answer for your domain.
Check whether your DNS host offers one-click DNSSEC with automatic key rollover — most managed hosts do, and it removes the operational risk.
Enable signing there and let it generate the keys.
Copy the DS record (or the DNSKEY, if the registrar asks for that) into your registrar's DNSSEC section.
Wait for the registry to publish the DS, then confirm a validating resolver still resolves the domain before you walk away.
How to confirm it worked
dig +dnssec DNSKEY ‹domain› — expect DNSKEY records
dig +short DS ‹domain› — expect a DS record at the registry
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
No DNSKEY record was found at ‹domain›, so the zone is unsigned. This is reported for information and deducts nothing: the large majority of domains are unsigned and nothing about the domain is broken. Signing is a real improvement and a real operational commitment — a signed zone whose signatures expire is worse than an unsigned one, because validating resolvers refuse the domain entirely. Enable it through a DNS host that manages the signing and the key rollovers for you.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- The zone's record names can be enumerated
- NSEC3 is configured with extra hash iterations
- NSEC3 opt-out weakens proof for unsigned subdomains
- DNSSEC could not be checked
- A DNSSEC signature has expired
- A DNSSEC signature expires within seven days