How it works
DNSSEC (RFC 4033 to 4035) adds digital signatures to a zone. Every set of records gets an RRSIG record carrying the signature and its expiry date, and the public keys are published as DNSKEY records. NSEC or NSEC3 records can even prove that a name does not exist.
For a resolver to trust those keys, there has to be a chain up to the root zone. A DS record in the parent zone, meaning at the .com or .de registry, holds a hash of your zone's key. The registrar usually submits the DS record, often automatically when the DNS host and registrar are the same company.
A validating resolver such as Google Public DNS, Cloudflare or Quad9 checks this chain on every answer. If everything verifies, it sets the AD flag. If something is off, for instance an expired signature or a DS record that no longer matches the key, it returns SERVFAIL, and the domain becomes unreachable for its users.
Why it matters
Without DNSSEC, a resolver cannot tell a forged answer from a genuine one, so DNS spoofing and cache poisoning can quietly send visitors and mail to someone else's server. DANE for mail servers requires DNSSEC outright.
Broken DNSSEC is worse than none. A DS record still pointing at the old key after a DNS provider switch, or automatic re-signing that silently stopped, takes the domain, website and mail offline for everyone behind a validating resolver. Because your own resolver often doesn't validate and keeps answering, the outage tends to be spotted late.
How to prevent it
- Enable DNSSEC at your DNS provider and confirm that the DS record has made it into the parent zone.
- Use a current algorithm, ideally ECDSA P-256 (13) or Ed25519 (15), and retire RSA/SHA-1 and older ones.
- Hand over DNSSEC cleanly before switching DNS providers: either remove the DS record and wait out its TTL, or add the new provider's key to the chain first.
- If you sign zones yourself, monitor automatic re-signing so signatures never expire.
- Test validation from the outside through a validating resolver, not just your own.
How DomainWarn detects it
The DNSSEC check looks for a DS record in the parent zone and queries the domain through a validating resolver. If DNSSEC is set up but validation fails, that is critical: after two runs DomainWarn opens a “DNSSEC broken” incident. No DS record at all is just a notice.
The check also watches signature expiry: under 7 days is a warning, under 2 days critical, both with a “DNSSEC signatures expiring” incident. For providers that sign for only a few days and renew daily, the thresholds only apply once the remaining share of the validity period gets low as well. Deprecated algorithms such as RSA/MD5, DSA, RSA/SHA-1 and GOST trigger a warning. Enabling or disabling DNSSEC and key rollovers show up as changes.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.