DNSSEC protects DNS data with digital signatures. If configured correctly, visitors will not notice anything amiss; however, if configured incorrectly, the domain may become completely inaccessible: the website will not load and emails will not be delivered. This is because the DNS resolvers carrying out the verification will not accept an incorrectly signed response, but will instead return an error (SERVFAIL).

The most common errors

Outdated DS record following a name server change

This is by far the most common scenario. The DS record in the TLD zone specifies which key must be used to sign the domain zone. If the domain is moved to new name servers but the DS record associated with the old provider’s key remains in the registry, the responses from the new name servers will not match it, and the resolvers will reject them. The same thing happens if the DS record remains but the zone is not signed at all by the new provider.

Expired subscriptions

Signatures (RRSIG) have an expiry date, so the zone must be re-signed regularly. If automatic signature renewal stops – for example, due to an incorrect setting on a private name server or because storage space has run out – the zone will become invalid after a few days or weeks.

Incorrect key replacement

Keys must be changed from time to time (key rollover). If the DS record for the new key is entered into the registry too early or too late, or if the old key is deleted before the caches have expired, the chain of trust will temporarily be invalid.

Manual zone editing without a signature

If the zone file is edited manually but is not re-signed after the changes, the new or modified records will not have a valid signature.

Other effects

• Larger responses: due to the signatures, DNS responses will be larger. Some older firewalls or routers do not allow large UDP packets through; in such cases, the query is repeated over TCP, which can slow down resolution.
• Non-validating resolvers: if a resolver does not support DNSSEC, it simply ignores the signatures, and the domain functions in exactly the same way as it would without DNSSEC. This therefore does not cause an error; it simply means that the user in question does not receive the protection.
• Ongoing maintenance: DNSSEC requires continuous monitoring; the task is not complete once it has been set up.

How can you check this?

• The simplest option is our free DNSSEC validation tool: for each zone, from the root to the domain, it displays the keys, DS records and signatures, and highlights the zone where the chain of trust breaks. This makes it immediately apparent if the DS record in the registry does not correspond to the zone’s current key, or if the zone is signed but there is no DS record in the parent zone.
• Check the domain using a validation resolver, and then again with validation disabled: dig pelda.hu @1.1.1.1 and dig +cd pelda.hu @1.1.1.1. If the first command returns a SERVFAIL error, but the second (with the +cd switch, without validation) returns a response, then there is almost certainly a DNSSEC error.
• The command dig +dnssec pelda.hu also displays the signatures. When using a validating resolver, the ad flag in the response header indicates that the response has been successfully validated.
• DNSViz (dnsviz.net) visually depicts this same chain of trust in a diagram.

How can this be fixed?

• Before changing your nameservers, disable DNSSEC: first, have the DS record deleted from the registry; wait until the old DS record has been cleared from the caches (this takes one or two days, depending on the TTL); and only then change your nameservers. The article ‘A record or name server change: which should I use?’ explains the process of making the change.
• If the problem has already occurred, the quickest solution is to delete the old DS record. Until the deletion propagates through the caches, the domain may still be inaccessible from certain networks. After deletion, you can use the DNSSEC validator to check that there is indeed no longer a DS record in the parent zone.
• If you have your own name server, check that the signing software is running and that the signatures are valid.

If your website does not load after changing the domain’s name servers, you can find further possible reasons in the article ‘Why won’t my website load after changing the NS records?’.