A DS record uses a SHA-1 digest.

DNSSEC_SHA1_DIGEST · Severity: Warning

• WarningDNSSEC_SHA1_DIGEST

  A DS record uses a SHA-1 digest.

  The IANA digest registry (RFC 9904) says SHA-1 must not be used to create new DS records. Validators that stop accepting SHA-1 can no longer follow the chain of trust through this record.

  Recommendation: Publish a DS record with a SHA-256 digest (digest type 2) and then remove the SHA-1 one.

Reported by

• DNSSEC check
• Domain health check

Available through the API

• DNSSEC check API
• Domain health check API

Related findings

• Error DNSSEC_BOGUS DNSSEC validation fails for the domain.
• Warning DNSSEC_DEPRECATED_ALGORITHM The zone uses a DNSSEC algorithm that should no longer be used.
• Error DNSSEC_DS_WITHOUT_DNSKEY A DS record has no DNSKEY with the same algorithm.
• Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
• Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.

All findings