DS record
Held by the parent zone. It is a digest of one of your keys, and it is what links your zone to the chain of trust above it. Published at the registrar, not at the DNS host.
A domain can be unsigned, correctly signed, or signed and broken. The third is much worse than the first — a broken chain makes the domain unreachable for every validating resolver, which includes most large ISPs — and telling it apart needs more than listing records.
Held by the parent zone. It is a digest of one of your keys, and it is what links your zone to the chain of trust above it. Published at the registrar, not at the DNS host.
The public keys your zone signs with. A key-signing key is the one the DS refers to; a zone-signing key does the day-to-day signing.
The signature over a record set, with a validity window. When that window closes and nothing has re-signed the zone, every answer becomes unverifiable.
How a validating resolver reports that it checked the signatures and they held. Its presence is the only confirmation that the chain works end to end.
A DS record contains a key tag and a digest. The tag is a sixteen-bit checksum used to find the right key quickly — it is not an identifier, and collisions happen. The digest is the actual cryptographic link.
A checker that matches tags and stops will report a working chain whenever a key with the right tag exists. That is exactly the state a half-finished key rollover leaves behind: the old DS still at the registrar, a new key in the zone, tags that happen to agree, and a chain that does not verify. This page computes the digest of the published key and shows it next to the one the parent publishes, so the comparison is the real one.
The second thing it does is ask the same question twice — once of a validating resolver, and once with validation switched off. A domain that answers the second way and fails the first is broken specifically because of DNSSEC, and that pattern is the only clean way to see it from outside. Nothing else produces it.
On signature expiry, the honest position is that a short window is not evidence of anything. Providers that sign answers on demand roll signatures in hours; zones signed on a schedule run for weeks. From a single observation you cannot tell a short window by design from re-signing that has stopped, so this reports the window and only raises it as a problem inside the final hour.
It depends on what a wrong answer would cost. DNSSEC stops a resolver being fed a forged record for your domain — which matters a great deal for a bank or a mail domain and very little for a brochure site. The real argument against it is operational: a mistake takes the domain off the internet entirely, which a missing DNSSEC never does. If you enable it, enable it where the DNS host handles the signing and key rollovers for you.
The zone is signing its answers and the parent has nothing to anchor them to, so resolvers ignore the signatures completely. It is the most common half-finished state, because publishing the DS happens at the registrar rather than the DNS host and is a separate step people forget.
That is the signature of a broken DNSSEC chain. Resolvers that do not validate — including some ISP resolvers and most default router configurations — will serve the domain normally, while every validating resolver returns SERVFAIL. This page tests both and will tell you if that is what is happening.
Remove the DS record at the registrar first, and wait for its TTL to expire everywhere before you stop signing the zone. Doing it the other way round — unsigning while the DS is still published — is precisely the broken state above.
Validating resolvers refuse the answer, so the domain stops resolving for them. It is a hard deadline with no grace period, which is why automated re-signing matters more than any other part of running DNSSEC.
A record changed by someone who left, a registrar nobody has the login for, a zone signed but never delegated. We take over the operation of this properly — documented, monitored, and changed through a process rather than through whoever is awake.