Finding: Domain Is Signed With DNSSEC But Did Not Resolve
This finding means your domain publishes a DS record — DNSSEC is enabled — but this scan could not resolve it to an address. A stale or mismatched DS record after a key rotation produces exactly this pattern.
Last updated August 11, 2026.
What it means
Nivaronix found a DS record for your domain at its parent zone, meaning DNSSEC signing has been turned on. Separately, and during the same scan, the ordinary A/AAAA resolution step for your domain failed. Together, these two facts are more specific than either alone: a domain that publishes a DS record instructs validating resolvers to refuse any answer whose signature doesn't check out, rather than return it anyway.
Why it matters
This exact combination — DS record present, resolution failing — is the signature of a stale or mismatched DS record, most commonly left behind after a DNSSEC key rotation that wasn't completed in the correct order. When that happens, the domain goes dark specifically for visitors behind a validating resolver, while it may still load fine from a cached answer or a non-validating resolver elsewhere — which is exactly why this class of outage is often reported late, once enough validating resolvers have expired their cache. We have confirmed the DS record and the resolution failure occurring together; we have not independently confirmed that a signature mismatch is the specific cause, since that requires full chain-of-trust validation this scan does not perform.
What Nivaronix checks
Nivaronix performs a DS lookup at your domain's parent zone as part of its DNSSEC check, and separately attempts standard A/AAAA resolution earlier in the same scan. This finding fires specifically when the DS record is present and that same scan's resolution attempt failed — not merely because DNSSEC is enabled.
Example evidence (illustrative — not live scan data)
DS example.com: 12345 13 2 3B4C... ; A/AAAA resolution failed during this scan
How to fix it
- Validate the DNSSEC chain for your domain immediately, using an independent full-chain tool such as dnsviz.net or
dig +dnssec <your-domain>. - If the DS record at your registrar no longer matches your DNS host's current signing key (DNSKEY), publish the correct, current DS record at the registrar.
- If you don't need DNSSEC and this happened during an incomplete rotation, consider disabling signing at your DNS host and removing the DS record at the registrar, then re-enabling it properly if you want it back.
How to verify the fix
Re-run the DNSSEC checker and confirm your domain resolves normally with the DS record still in place, and cross-check the full chain at dnsviz.net.