inspect.ZONE Delegation-aware DNS Reports Knowledgebase

DNSSEC: the chain of trust

Published September 4, 2026. Updated September 9, 2026.

DNSSEC signs your DNS records so a resolver can verify the answers really came from you and were not tampered with in transit. It works as a chain: the parent vouches for your keys, your keys sign your zone.

The three pieces this report checks

  • DS at the parent: a Delegation Signer record in the registry that fingerprints your signing key. This is what links your zone into the global chain of trust.
  • DNSKEY at the child: the public keys published in your zone.
  • RRSIG: signatures on your records (for example on the SOA), produced by those keys.

For DNSSEC to validate, all three must be present and consistent: the DS at the parent must match a DNSKEY in your zone, and your records must carry valid RRSIGs.

A common failure

If the DS exists at the parent but your zone is unsigned or the keys changed without updating the DS, validation fails closed: security-aware resolvers return SERVFAIL and your domain disappears for many users. Never remove signing or roll keys without updating the DS.

How to fix it

Enable DNSSEC at your DNS provider, then give the DS record it generates to your registrar (the parent). To turn DNSSEC off, remove the DS at the registrar first, wait for it to expire, then unsign the zone.

How to verify

dig example.com DNSKEY +short
dig example.com SOA +dnssec +short     # look for RRSIG
dig example.com DS @a.gtld-servers.net # the parent's DS

A resolver that validates (for example dig example.com +dnssec against 1.1.1.1) should return the answer with the ad (authenticated data) flag set and no SERVFAIL.

Common mistakes

  • Changing DNS providers with DNSSEC on. Moving nameservers without a coordinated key rollover leaves the parent's DS pointing at keys the new provider does not have, so the domain fails closed. Turn DNSSEC off (remove the DS, wait out its TTL) before migrating, then re-enable at the new provider.
  • Removing the DS last instead of first when disabling. Always remove the DS at the registrar and let it expire before you unsign the zone.
  • Assuming "signed" means "validating." Signatures with no matching DS at the parent do nothing; the DS is what anchors the chain.

See also