Result
How the chain of trust works
Your domain’s zone is signed with a key (DNSKEY). For resolvers to trust that key, the registrar deposits a fingerprint of it – the DS record – with the registry of the extension, for example DENIC for .de. The registry in turn is confirmed by the root zone. If DS and DNSKEY match, the chain is complete.
A broken chain is dangerous, for example after a change of provider with an old DS record left in place. Validating resolvers then discard the answers and the domain becomes unreachable for a large part of the internet. We detect this case and report it as an error.
Frequently asked questions
Do I need DNSSEC?
DNSSEC is not mandatory, but it noticeably increases security – for example against redirected mail or forged websites. It is also a prerequisite for techniques such as DANE.
What do KSK and ZSK mean?
The key signing key (KSK, flag 257) only signs the zone’s keys and is anchored via the DS record. The zone signing key (ZSK, flag 256) signs the actual records.
Domains and DNS in good hands
1blu business GmbH looks after domains, DNS and mail servers for companies, agencies and resellers – with dedicated contacts instead of a call centre.