Help & Troubleshooting
DNSKEY Record
What this is
DNSKEY records publish the public keys of a DNSSEC-signed zone. The Key Signing Key (flags 257) is anchored by the parent's DS record; Zone Signing Keys (flags 256) sign the zone's record sets.
How to read your result
A signed zone shows at least one KSK and typically one ZSK. No DNSKEY records simply means the zone is not signed. If keys exist, the crucial question is whether the parent's DS record matches the current KSK — run the DNSSEC status look up for the combined picture.
Common problems and how to fix them
Keys were rolled but the DS record still matches the old KSK
How it shows up: The domain suddenly fails to resolve on validating resolvers (SERVFAIL on 8.8.8.8 / 1.1.1.1) while appearing fine on non-validating ones.
How to fix it: Generate the DS for the current KSK and update it at the registrar immediately. During planned rollovers, publish old and new keys side by side and only retire the old key after the new DS has propagated.
DNSKEY present but zone was moved to a provider without DNSSEC
How it shows up: After a DNS migration the domain goes dark for many users; the old provider's keys no longer answer.
How to fix it: Before migrating a signed zone, either transfer the signing setup or remove the DS record at the registrar first, wait for it to expire from caches, then migrate and re-sign at the new provider.