webzod
account

Make your DNSSEC signatures something resolvers can validate

dns.dnssec.not_validated · effort: about an hour

Why it matters

The zone is signed and the registry holds a DS record, yet validating resolvers neither accept nor reject the answers. They treat the zone as unsigned, which happens when they support none of its signing algorithms or DS digest types, so DNSSEC protects nobody.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

  1. Look up the algorithm of the zone's keys and the digest type of the DS record with the commands below. The finding names them too.
  2. If the algorithm is not 8 (RSA/SHA-256), 13 (ECDSA P-256) or 15 (Ed25519), or the DS digest type is not 2 (SHA-256), move to supported values. Your DNS provider usually offers this as a managed algorithm rollover.
  3. Follow the rollover order exactly. Sign with the new algorithm next to the old one, add the new DS record at the registrar, wait for the old DS record's TTL after removing it, and only then remove the old keys. Removing keys while their DS record is still published makes the domain unreachable for validating resolvers.
  4. If only the DS digest type is the problem, add a DS record with digest type 2 for the same key at the registrar, check it, then remove the old one.
  5. Confirm with a validating resolver that answers now carry the ad flag, and check the chain with DNSViz.
bash 
dig +dnssec DNSKEY example.com +short
dig DS example.com +short
dig @1.1.1.1 A example.com +dnssec | grep -E "flags|status"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.