Search... ⌘ K
Get Started Contact Sales

Troubleshoot DNSSEC

Last updated

Most DNSSEC problems come from a DS record at the registry that doesn’t match the keys signing your zone, which makes validating resolvers return SERVFAIL for your domain. Check the DNSSEC state in DNSimple, test the domain with a DNSSEC diagnostic tool, then fix the DS record at the registry.

If you’re new to DNSSEC, start with What Is DNSSEC? to understand what DNSSEC is and how it works. For a comprehensive overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.

Table of Contents

Is DNSSEC active for your DNSimple domain?

There are two ways to check this:

  1. Domain Names list: In your list of domains, look for a label on the domain. If present, it indicates DNSSEC is enabled.
  2. DNSSEC tab: On the domain page, click the tab on the left side. The card at the top shows the DNSSEC state, such as , , or an operation in progress like a key rotation. While DNSSEC is active, the section shows the algorithm, key tag, creation date, and next scheduled rotation.

Essential tools for diagnosing DNSSEC issues

Before attempting fixes, verify the DNSSEC state of the domain using external diagnostic tools. These tools help identify where the DNSSEC chain of trust is failing and are often the fastest way to understand the problem.

See External DNSSEC Diagnostic Tools for a list of recommended tools and what each one checks.

After identifying the reported error, return here and follow the resolution steps below.

Common DNSSEC issues and their resolutions

This section details the most frequent problems identified by the tools and provides actionable steps to fix them, ensuring your DNSSEC is properly set up with DNSimple.

Incorrect or missing DS records in the parent zone (registrar not DNSimple)

Symptoms: DNSSEC Analyzer/DNSViz report “No DS records found for domain” or “DS record mismatch.” dig output lacks the AD flag. This is the single most common cause of DNSSEC validation failure.

Why it happens: The DS records weren’t provisioned, were provisioned incorrectly, or haven’t propagated yet.

Resolution steps:

  1. Find DNSimple’s DS record: Use the DS record from the email we sent when you enabled DNSSEC. During a key rotation, the new DS record also appears under on the tab. To check which key is active, compare the under with the key tag of the DS record at your registrar.
  2. Access your registrar: Log in to your domain registrar’s website and provision the DS record. Instructions will vary depending on your particular domain registrar (for example, GoDaddy or Namecheap).
  3. Allow propagation: Registrar updates can take anywhere from a few seconds to a few hours, and cached DS records will invalidate after 24 hours. Re-check with DNSSEC Analyzer.

Domain stops resolving after you change name servers

Symptoms: After you move your DNS to or from DNSimple, validating resolvers return SERVFAIL, while non-validating resolvers still answer.

Why it happens: The DS record at the registry still points to the old provider’s keys, and the new provider either doesn’t sign the zone or signs it with different keys.

Resolution steps: Remove or replace the DS record so it matches the new provider. See Manage DS Records When Changing DNS.

Expired RRSIG (Resource Record Signature) records

Symptoms: DNSSEC Analyzer/DNSViz show “Signature Expired” or “RRSIG Validation Failure.”

Why it happens: A DNSSEC operation on your domain didn’t successfully complete, and DNSSEC key sets were left in place, eventually getting expired.

Resolution steps:

  1. Check your email inbox: Check your email for any automated DNSSEC notifications, and follow the included instructions. Our system will automatically notify you when a DNSSEC operation doesn’t complete successfully.

Contact DNSimple support

Please reach out to our support team about any DNSSEC-related issues.

Before contacting support, please gather the following information:

  • Your domain name: for example, example.com.
  • Description of the problem: What exactly is failing? For example, “DNSSEC Analyzer shows ‘DS record mismatch’” or “My site isn’t loading for users in Europe when DNSSEC is enabled.”
  • Tools used and their output:
    • Screenshots from DNSSEC Analyzer and DNSViz are helpful.
    • The exact dig +dnssec output.
    • Any specific error messages you’ve encountered.
  • Steps you’ve already taken: for example, “I’ve verified DS records at my registrar multiple times” or “I’ve tried toggling DNSSEC off and on in DNSimple.”
  • Time of observation: When did you first notice the issue?

Providing this information allows our support team to diagnose and resolve your DNSSEC issue much more quickly, getting your secure DNS up and running again.

Have more questions?

If you have additional questions or need any assistance with DNSSEC on your domain, just contact support, and we will be happy to help. You can also read more about domain and DNS security at DNSimple.