Add a SHA-256 DS record on Cloudflare
Why it matters
The only DS record at your registrar uses the SHA-1 digest type, which is deprecated and no longer recommended. A DS record with a SHA-256 digest of the same key is a drop-in replacement.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Cloudflare's DS record uses digest type 2 (SHA-256). Open DNS then Settings and copy the DS record shown there.
- Add it at the registrar and remove the old SHA-1 record once the new one has been live for longer than its TTL.
Related
- Reported by the DNSSEC check
- Repair broken DNSSEC so validating resolvers can resolve the domain
- Make your DNSSEC signatures something resolvers can validate
- Publish the DS record at your registrar
- Find out why resolvers disagree about your DNSSEC
- Turn on DNSSEC
- Move DNSSEC to a stronger signing algorithm
Scan your domain to see whether this applies to you.