How do I fix "DNSSEC is broken"?

If you recently changed DNS providers: remove the old DS record at the registrar or complete the key handover. If signatures expired: re-sign the zone at the DNS host. Until fixed, validating resolvers (a large share of the internet) can't resolve the domain.

DNSSEC is broken

Check id: dnssec.broken · fix effort: medium

What it means

Your domain's DNS security signatures are invalid. For a large share of the internet, your domain simply won't load until this is fixed.

The technical detail

Queries with DNSSEC validation SERVFAIL while checking-disabled queries succeed. Typical causes are expired RRSIGs or a stale DS after a provider move.

How to fix it

If you recently changed DNS providers: remove the old DS record at the registrar or complete the key handover.
If signatures expired: re-sign the zone at the DNS host.
Until fixed, validating resolvers (a large share of the internet) can't resolve the domain.

Does your domain have this problem?

Run a free scan, takes about ten seconds.