DNSSEC enabled

What this means

Passing means your DNS zone is signed and the signature chain is published, so a resolver can prove the answers it gets for your domain are the ones you published. Failing means the zone is unsigned, which is the default on most domains. This is a low-severity check: it protects against a specific attack rather than a common misconfiguration.

How we test it

We look for a DS record for your domain at the parent zone and for RRSIG records in the answers your nameservers return. Both present is a pass. Neither present is a fail. Only one of the two present means the chain is incomplete, and we report that as a warn. This is a passive check.

Why it matters

Prevents cache-poisoning of the domain. Without signing, a resolver that is fed a forged answer for your domain has no way to tell, and a forged answer can point your users, or your own mail, somewhere else. With signing, the forged answer fails validation and is discarded. The Fix Kit does not cover DNSSEC in depth, so the fix below stays short.

The fix

Turn on DNSSEC in your DNS provider's dashboard for the zone, then publish the DS record it gives you at your registrar (when Cloudflare is both registrar and DNS, this is a single setting). Confirm with dig +short DS YOUR_DOMAIN returning a record and dig +dnssec A YOUR_DOMAIN showing an RRSIG in the answer.

The full runbook is in the Fix Kit, Module 00.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change any DNS or registrar setting. Run: dig +short DS YOUR_DOMAIN and show me the output.
Run: dig +dnssec A YOUR_DOMAIN and tell me whether the answer section contains an RRSIG record and whether the ad flag is set.
Run: dig +short NS YOUR_DOMAIN and name the DNS provider.
Tell me whether the zone is signed, whether a DS record is published at the registrar, or whether both are missing.
List what it would take to enable DNSSEC with this DNS provider and this registrar, and stop there.
Finally run: dig +short DS YOUR_DOMAIN | grep -c . and show the count. Expected 1 or more once DNSSEC is on.

Copy the prompt