DNS / email · Check
DNSSEC chain broken — fixing the validation failure before resolvers reject your zone
DS records exist at your parent zone — meaning your registrar and DNS host *think* DNSSEC is enabled — but a validating resolver could not authenticate the answer. The most common cause is a key rotation where the new DNSKEY was published but the matching DS at the registrar was never updated. Validating networks (a growing list, including some carrier resolvers) will return SERVFAIL and your domain becomes unreachable for those users.
Why it matters
This is more urgent than "unsigned": users on DNSSEC-validating networks may already be unable to reach your site. Verify the active DNSKEY at your DNS host matches the DS published at your registrar, then re-test with `dig +dnssec` or a public DNSSEC analyzer.
Real-world risk
A broken DNSSEC chain causes validating resolvers to return SERVFAIL — users on those networks cannot reach your site at all. This is an availability incident waiting to be discovered, not just a hardening gap.
Fix steps (in order)
- Treat this as an outage in progress: validating resolvers (Cloudflare 1.1.1.1, Quad9, some carriers) are already returning SERVFAIL for your domain.
- Compare the active DNSKEY at your DNS host with the DS record published at your registrar — the most common cause is a key rotation where the new DS was never published.
- If you cannot fix the chain quickly, withdraw the DS at your registrar to revert to unsigned (better than broken). Re-enable DNSSEC properly afterwards.
- Verify the fix with: dig +dnssec yourdomain.com (AD flag set) and dnsviz.net (green chain end-to-end).
Topic explainer
DMARC, SPF, and DKIM explained: the email authentication trio →
A practical guide to email authentication: what SPF, DKIM, and DMARC each do, why all three are needed, and how to roll out a DMARC policy that actually blocks spoofed mail.
Verify the fix in 30 seconds
Run a Scorifya scan on the affected host after deploy. The same finding id (dns_dnssec_validation_failed) clears once the externally-observable signal is in place.