Finding: DNSSEC Not Enabled
This finding means no DS record is published for your domain at its parent zone, so DNSSEC is not enabled. Answers for your domain are not signed, and a validating resolver has no way to detect if they were tampered with in transit.
Last updated August 9, 2026.
What it means
DNSSEC signs DNS answers so a validating resolver can verify they came from the real zone owner and weren't altered. Without a DS record at the parent zone, there's nothing for a resolver to validate against — the domain simply isn't in the chain of trust.
Why it matters
Most domains today run without DNSSEC and function normally; this is a low-severity, defense-in-depth finding rather than an active exposure. Without it, a resolver has no cryptographic way to detect DNS cache-poisoning or on-path tampering with responses for your domain — it simply has to trust whatever answer it receives.
What Nivaronix checks
Nivaronix performs a live DS lookup for your domain. This finding fires when the lookup authoritatively returns no DS record.
Nivaronix checks whether DNSSEC is enabled — specifically, whether a DS record is published at the parent zone, and whether our resolver's response carried the authenticated-data (AD) flag for that lookup. This is a presence-and-signature-status check, not full chain-of-trust validation from the root down through every intermediate zone. For an independent, full-chain validation view, use a dedicated tool such as dnsviz.net.
Example evidence (illustrative — not live scan data)
DS example.com: no DS record at the parent zone
How to fix it
- Confirm your DNS host supports DNSSEC signing — most major managed DNS providers do, usually as a toggle in the domain's DNS settings labeled "DNSSEC" or "Enable signing."
- Enable it. The DNS host will generate signing keys and a DS record for the zone.
- Take that DS record to your registrar (the party your domain is registered with — this may or may not be the same company as your DNS host) and add it under the domain's DNSSEC or "DS records" settings.
- Wait for propagation, then verify.
- Before ever disabling DNSSEC or rotating keys later, remove the DS record at the registrar first and let it propagate before turning off signing at the DNS host — reversing that order is what causes a "signed but unresolved" outage.
How to verify the fix
Re-run the DNSSEC checker and confirm it now reports DNSSEC enabled. For full chain-of-trust validation beyond presence and signature status, also check the domain at dnsviz.net.