Domains & DNS
DNSSEC validation errors: trace broken signatures and delegation
DNSSEC validation errors occur when the chain of trust says signed data should verify but a resolver cannot validate it. The resulting failure can look like a domain outage even though authoritative servers still answer. Troubleshooting should follow the chain from parent DS to child DNSKEY and signed RRsets.
Confirm the failure with a validating resolver
Compare a validating public resolver with direct authoritative queries. If authoritative servers answer but validating recursive resolvers return SERVFAIL, DNSSEC becomes a strong suspect.
Use DNSSEC-aware tools that display DS, DNSKEY, RRSIG, algorithm, key tag and validation state.
Check parent DS against active DNSKEY
The DS record lives at the parent and must correspond to a DNSKEY published by the child zone. A stale DS after changing DNS providers is a common way to create a signed-but-unverifiable delegation.
Verify the key tag, digest type, digest and algorithm together.
Inspect signatures and time validity
RRSIG records have inception and expiration times. Clock errors or a signing system that stopped refreshing signatures can invalidate otherwise correct keys.
Confirm all authoritative servers serve the same current signed zone and that denial-of-existence records such as NSEC/NSEC3 are coherent.
Recover without creating a longer broken chain
Fix the signing/key mismatch at the correct layer. If DNSSEC must be removed, follow the registrar or DNS-provider procedure so the parent DS is removed safely before signing is disabled in the child.
- Compare validating and authoritative answers.
- Match parent DS to child DNSKEY.
- Check signature timing.
- Remove DNSSEC only with chain-aware sequencing.