DNSSEC

What this check looks at

Hardening group · check id dnssec · all thirteen checks

“Signs your DNS answers so an attacker cannot forge the records above.” - the wording shown beside this check while it runs.

DNSSEC signs your DNS records so a resolver can prove the answer it received is the answer you published, and was not altered on the way. Without it, DNS answers are simply believed.

Why it matters

Every other record on this page is a DNS record. An attacker in a position to forge DNS answers can replace your SPF, DKIM and DMARC records with their own for the receivers they can reach, and every protection above quietly evaluates against the attacker's version.

In practice this attack is far rarer than plain forgery, which is why this sits in hardening rather than authentication. It is worth doing, and it is worth doing after the three records above.

What each verdict means here

Pass

The zone is signed and the chain of trust is present.

Warn

Partially configured - the commonest cause is a signed zone whose DS record was never published at the registrar, which is worse than not signing at all.

Not applicable

The zone is not signed. Most domains are not, and this is not counted against the score.

What to do

1. Check whether your DNS provider offers one-click DNSSEC - many do, and it handles both halves.
2. If you enable it manually, the DS record must be published at the registrar. A signed zone without it can make the domain unreachable.
3. Do this after SPF, DKIM and DMARC. Signing a zone whose authentication records are wrong protects the wrong answer faithfully.

What this check does not do

We check the published state. Key rotation, algorithm strength and registrar-side chain validation are not assessed.