DNSSEC not enabled
Check id: dnssec.missing · fix effort: medium
What it means
DNS answers for your domain aren't cryptographically signed, so they can be forged in transit. Most DNS hosts turn this on with one click.
The technical detail
No validated AD flag. The zone is unsigned or the DS isn't published at the registrar.
How to fix it
- Enable DNSSEC at your DNS host (Cloudflare/most registrars: one click).
- Publish the DS record at the registrar if it isn't automatic.
- Verify the AD flag with a rescan.
Does your domain have this problem?
Run a free scan, takes about ten seconds.