DNSSEC not enabled (no DS records)
If this finding appears in a report, the sampled DNS lookup did not return the expected DS record. Confirm the queried domain, response and authoritative parent-zone state before concluding that the public DNSSEC chain is absent. This reference page does not inspect your domain. Other audit tools often report this finding as "DNSSEC unsigned".
Why this matters
DNSSEC lets validating resolvers authenticate DNS data through a chain of trust. It does not establish that an application is secure. A missing DS observation is not proof of an attack, and a signed zone without the appropriate parent delegation does not complete the public trust chain. Incorrect or stale DS records can cause resolution failures.
How to fix it
Review current signing and delegation with the DNS and registrar owner. Follow both providers' documented procedure: enable supported zone signing and publish the matching DS data at the parent through the registrar where required. Verify authoritative DNSKEY and DS records plus resolution through a validating resolver. Before a nameserver or key change, account for existing DS records and TTLs and use the provider's migration and rollback guidance. Do not toggle settings or copy stale DS data merely to clear a finding.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit