Check DNSSEC
The checks run against Cloudflare's validating resolver over DNS-over-HTTPS, with Google's as a fallback.
How it works
DNSKEY
The zone's public keys are fetched. Flag 257 is a key-signing key, 256 a zone-signing key. The algorithm number tells you how modern the setup is.
DS
The DS record lives at the parent — the registry — and is set through your registrar. Without it the signatures are never checked.
AD flag
Cloudflare's resolver validates the chain and sets AD when it succeeds. That is the only proof the whole thing works end to end.
Verdict
SERVFAIL means a DS that matches nothing — the domain is dark for most of the internet. The other states are explained inline.
Why this is on a cold email site
DNSSEC is not a deliverability signal. Google does not weight it, Microsoft does not weight it, and a fleet of unsigned sending domains lands exactly as well as a signed one. It is here because a broken DNSSEC chain is one of the few faults that takes a domain completely offline — no website, no MX, no SPF lookup — for everyone behind a validating resolver, which today is most of the internet. And it breaks in a way that looks like nothing: the records are all there when you look at them in the DNS provider's panel.
How it breaks
The usual story is a domain moved between DNS providers. DNSSEC was enabled at the old provider, which published a DS record at the registrar. The nameservers were changed, the new provider has no keys, and the DS was never removed. Now Cloudflare's resolver fetches the DS, looks for a matching DNSKEY, finds none, and returns SERVFAIL. Some resolvers still answer, so the site works from your office and fails for half your clients. I have seen this cost a week of outbound while everyone blamed the sending tool.
The three states
Signed means the zone has DNSKEY records and signatures. Delegated means the parent holds a DS that matches one of those keys. Validating means a resolver walked the chain and set the AD flag. All three together is working DNSSEC. Signed without a DS is harmless but pointless. A DS without a matching key is the broken case. This tool reports each separately so you know which step to fix.
If you want to enable it
On Cloudflare it is one toggle under DNS → Settings, which gives you a DS record to paste into the registrar. Use algorithm 13 — it is the default and produces small records. Then wait for the parent to publish the DS and run this check until the AD flag is set. If you ever move DNS providers again, disable DNSSEC and confirm the DS is gone from the registrar before you change nameservers.
Frequently asked questions
Does DNSSEC improve email deliverability?
No. Neither Google nor Microsoft factor it into filtering. It matters for cold email only in that a broken chain makes the domain unresolvable, and it is a prerequisite for DANE.
What does SERVFAIL mean here?
A validating resolver tried to verify the chain and failed — almost always because the DS record at the registrar does not match any key in the zone. The domain is effectively offline for most users.
What is the difference between DNSKEY and DS?
DNSKEY records live in your zone and hold the public keys. The DS record lives one level up, at the registry, and holds a hash of your key-signing key. The DS is what links your zone into the chain of trust.
Which algorithm should I use?
13 (ECDSA P-256 with SHA-256). It is what Cloudflare and most modern providers default to. Algorithms 5 and 7 use SHA-1 and are being retired.
Why does a signed zone show 'no DS at parent'?
Signing was enabled at the DNS provider but the DS it generated was never added at the registrar. Nothing is validated until it is.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace — Silver Partner
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.