Signed DNS records (DNSSEC)

What we check

We ask a public DNS service whether the domain is signed with DNSSEC and whether the signatures are correct. There are three possible results:

• active: the records are signed and the signatures valid.
• not active: the records are not signed. This results in a note.
• faulty: the domain is registered for DNSSEC, but the signatures do not match. This is a serious defect.

Why it matters

The DNS is the phone book of the internet. Anyone who opens example.ch first asks the DNS for the address of the server. Without DNSSEC this answer can be forged on the way, for example in a manipulated Wi-Fi network or through an attack on a DNS server. Visitors and emails then end up at a foreign server.

DNSSEC gives the answers a digital signature, and forged answers are discarded. Many internet providers and public DNS services such as those of Google, Cloudflare or Quad9 check these signatures.

This is exactly why faulty signatures are worse than none: if the signature does not match, the internet provider also discards the genuine answer. The website and the emails of the domain are then no longer reachable for many people, although everything runs on the server. This typically happens after a change of DNS provider, when the old key is still stored at the registry.

How to fix it

Switch DNSSEC on

If domain and DNS records are with the same provider, it is usually a switch in the domain administration. With providers such as Cloudflare, IONOS, OVHcloud or Infomaniak you find it in the DNS settings of the domain.

If the DNS records are with a different provider than the domain, for example with Cloudflare or an agency, two steps are needed:

1. The DNS provider signs the records and shows a so-called DS record.
2. This DS record is entered at the provider where the domain is registered.

Fix faulty signatures

Contact the domain provider immediately. Usually an outdated DS record has to be removed or replaced by the current one. As an emergency measure DNSSEC is switched off temporarily until the signatures match.

Before changing provider

Switch DNSSEC off before moving the DNS records and only switch it on again afterwards at the new provider. This way you avoid an outage.

How to check it yourself

The free service dnsviz.net shows the chain of signatures of a domain graphically. Red entries mean errors.

Frequently asked questions

How much does DNSSEC count in the score?

Little, at most 5 of 100 points in the security area, because it is an additional safeguard. Faulty signatures should still be fixed immediately: they make the website unreachable for many visitors.

Does DNSSEC cost anything?

With most providers, no. It is a setting in the domain administration.