DNSSEC
What it can report
- ✗ high validation fails: SERVFAIL that checking disabled resolves, or a DS with no DNSKEY How to fix it
- ! medium DS and DNSKEY published but every resolver answers without AD (insecure to them, e.g. an unsupported algorithm) How to fix it
- ! medium zone is signed but the parent has no DS record How to fix it
- ! medium one validating resolver validates, the other does not How to fix it
- ! low no DNSSEC at all How to fix it
- ! low signed with a deprecated algorithm (RSA/SHA-1, DSA, GOST, MD5) How to fix it
- ! low the only DS digest type is SHA-1 How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 2 within DNS. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.