Publish the DS record at your registrar on Cloudflare

Why it matters

Your zone is signed, but the registry has no DS record linking it to the parent zone, so validating resolvers treat the signatures as unverifiable. DNSSEC gives you no protection until the DS record is added.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Open DNS then Settings and look at the DNSSEC section. Cloudflare shows the DS record values (key tag, algorithm, digest type and digest).
2. Cloudflare adds the DS record for you only at Cloudflare Registrar and for .ch and .cz domains, which can take one to two days. At any other registrar, add the values at the registrar yourself.
3. Cloudflare marks DNSSEC as active when it sees the DS record.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Make your DNSSEC signatures something resolvers can validate
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Move DNSSEC to a stronger signing algorithm
• Add a SHA-256 DS record