DNSSEC validation fails for the domain.

DNSSEC_BOGUS · Severity: Error

• ErrorDNSSEC_BOGUS

  DNSSEC validation fails for the domain.

  Validating resolvers answered SERVFAIL, but the same query with validation turned off (the CD flag) succeeded while a DS record exists. Resolvers that validate refuse to answer for the domain, so mail and web traffic to it can fail for many users.

  Recommendation: Check that the DS record at the registrar matches a DNSKEY the zone publishes and that the signatures have not expired. A recent key rollover or a change of DNS provider is the usual cause.

Reported by

• DNSSEC check
• Domain health check

Available through the API

• DNSSEC check API
• Domain health check API

Related findings

• Warning DNSSEC_DEPRECATED_ALGORITHM The zone uses a DNSSEC algorithm that should no longer be used.
• Error DNSSEC_DS_WITHOUT_DNSKEY A DS record has no DNSKEY with the same algorithm.
• Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
• Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.
• Warning DNSSEC_SHA1_DIGEST A DS record uses a SHA-1 digest.

All findings