A DS record has no DNSKEY with the same algorithm.

DNSSEC_DS_WITHOUT_DNSKEY · Severity: Error

• ErrorDNSSEC_DS_WITHOUT_DNSKEY

  A DS record has no DNSKEY with the same algorithm.

  A DS record at the parent must point to a key the zone publishes. If no DS record matches a published key, validating resolvers treat the domain as bogus; an extra DS often means a key rollover was not finished.

  Recommendation: Remove DS records for keys the zone no longer publishes, or publish the matching DNSKEY.

Reported by

• DNSSEC check
• Domain health check

Available through the API

• DNSSEC check API
• Domain health check API

Related findings

• Warning DNSSEC_DEPRECATED_ALGORITHM The zone uses a DNSSEC algorithm that should no longer be used.
• Error DNSSEC_BOGUS DNSSEC validation fails for the domain.
• Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
• Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.
• Warning DNSSEC_SHA1_DIGEST A DS record uses a SHA-1 digest.

All findings