DNSSEC monitoring: follow keys, delegation and validation evidence

01DNSSEC changes cross an administrative boundary

DNSSEC involves more than publishing a DNSKEY record in a zone. A parent DS record establishes a link to the child zone's key material. Registrar and DNS provider settings therefore need to agree during setup and key changes.

DNStracr exposes DNSSEC evidence alongside DNS records. Monitoring DNSKEY and DS resources and reviewing resolver responses helps you investigate changes, but record presence alone must not be mistaken for a successful full-chain validation.

02Example: a parent still refers to the previous key

This fictional sequence illustrates a mismatch to investigate. It is not a key-rollover procedure: safe rollover timing depends on the provider, existing records and caching.

Before: parent DS matches a published child key
Change: provider replaces key material
After:  parent DS has no matching published key
Review: delegation and validating resolver evidence

1. Review the DNS provider's documented rollover process before changing keys.
2. Inspect parent DS and child DNSKEY evidence for the same domain.
3. Check whether a validating resolver reports a failure; distinguish failed queries from absent data.
4. Coordinate any correction with the registrar and DNS provider, then review later observations.

03Interpret a passed check carefully

The free scan checks whether a published key matches the parent signature reference and uses Cloudflare resolver validation evidence. It does not independently validate every signature in the trust chain.

An unsigned domain and a broken signed domain are different situations. Absence of DNSSEC is not evidence of a successful signed deployment. Review what the check actually measured instead of treating a green result as a broad security certificate.

04DNSSEC is not service availability

DNSSEC authenticates DNS data within its validation model; it does not encrypt DNS traffic or verify a website's TLS certificate. Correct signed records cannot establish that an application is reachable or mail will be delivered.

Periodic checks can miss short-lived failures. Use your provider's operational guidance for rollovers and incident response. The free scan offers an initial snapshot; enable the relevant monitors for continuing record observations.

Put this into practice

• Understand monitoring rules — Choose the DNSSEC check and review the expected result.