Is DNSSEC turned on for your domain?
The DNSSEC check reads whether the parent zone of your domain publishes a DS record, which shows DNSSEC signing is set up. DNSSEC lets resolvers verify that DNS answers for your domain were not forged.
What does this check look at?
It looks at whether the parent zone of your domain publishes a DS record, which shows DNSSEC signing is set up. Cloudflare explains that DNSSEC adds cryptographic signatures to existing DNS records, and that the DS record transfers trust from a parent zone to a child zone.
Reading DNS records, certificate logs and domain registration never touches your site.
Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | A DS record is published, so signing is set up. | Nothing. |
| Attention | No DS record is published. | Optional. Turn on DNSSEC at your DNS host and registrar. |
| Not tested | The lookup did not complete. | Nothing to act on. |
It does not validate individual DNS answers, and an unsigned domain is informational. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone sending mail or resolving your domain |
| The protection that should stop it | A DNS setting read from public records |
| What is reached | Email and DNS trust decisions |
| What follows | A hardening gap for your domain |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-345 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Many DNS hosts turn DNSSEC on with one switch, then give you a DS record to add at your registrar.
Help me turn on DNSSEC for my domain. Ask me which company hosts my DNS and which company is my registrar. Tell me where the DNSSEC switch is at the DNS host, what DS record values it gives me, and where to paste them at the registrar. Warn me before any step that could take my domain offline if done out of order.How to check
Say Atlas, our example app at atlas.example, uses a DNS host with DNSSEC available but switched off. The check marks it for attention as information, with no effect on the grade.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Is a domain without DNSSEC unsafe?
Not on its own. Most domains do not use it. It protects against forged DNS answers, which is a narrower risk than most other checks here.
Can turning on DNSSEC break my site?
It can if the DS record at the registrar does not match the keys at the DNS host. Follow your DNS host’s steps in order.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How does DNSSEC work? Cloudflare Learning Center, read on October 7, 2026
- How we check Lockpick docs, read on October 7, 2026
- How we rate findings Lockpick docs, read on October 7, 2026