Skip to content
whois.me.uk
Menu
Sign in

DNSSEC-NOT-VALIDATED

DNSSEC records exist but validation fails

What it means

A DS at the parent that does not match a DNSKEY in the zone, or expired signatures, makes validating resolvers treat the zone as bogus. Users behind such resolvers cannot reach you at all.

How to fix it

  1. 1Compare the DS digest at the registrar with the KSK in the zone; regenerate the DS if keys were rolled.
  2. 2Check RRSIG inception and expiration times; re-sign the zone if signatures have lapsed.
  3. 3If you cannot fix it quickly, remove the DS at the registrar to fall back to unsigned resolution.

Re-check after the change

DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.