Make your DNSSEC signatures something resolvers can validate on Cloudflare

Why it matters

The zone is signed and the registry holds a DS record, yet validating resolvers neither accept nor reject the answers. They treat the zone as unsigned, which happens when they support none of its signing algorithms or DS digest types, so DNSSEC protects nobody.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Cloudflare signs with algorithm 13 and shows a DS record with digest type 2. Compare those values with the DS record at your registrar and replace the registrar's record if it differs.
2. If another signer (a second DNS provider) adds keys with an old algorithm, change the algorithm there first, using the rollover order from the generic entry.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Publish the DS record at your registrar
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Move DNSSEC to a stronger signing algorithm
• Add a SHA-256 DS record