Repair broken DNSSEC so validating resolvers can resolve the domain on Cloudflare

Why it matters

The domain publishes DNSSEC data that fails validation, so resolvers that check it (many ISPs and public resolvers) refuse to answer and the domain looks down to those users. It is typically caused by a DS record that no longer matches the keys, or expired signatures.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Open DNS then Settings and look at the DNSSEC section. Compare the DS record shown there with the DS record at your registrar. They must match exactly.
2. If they differ (for example after disabling and re-enabling DNSSEC, or after moving the domain), replace the registrar's DS with the one Cloudflare shows.
3. A common case is that DNSSEC is switched off in Cloudflare but the registrar still holds the old DS record. Remove that DS record at the registrar, or switch DNSSEC on again in Cloudflare and publish its new DS record.
4. If you cannot fix it quickly, remove the DS record at your registrar to restore resolution, wait for its TTL, and add it back once Cloudflare shows the correct values.
5. When moving a domain to Cloudflare's nameservers from a provider with DNSSEC on, remove the old DS at the registrar first.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Make your DNSSEC signatures something resolvers can validate
• Publish the DS record at your registrar
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Move DNSSEC to a stronger signing algorithm
• Add a SHA-256 DS record