DNSSEC adds signatures and a chain of trust to DNS data. SSLBoard groups discovered hostnames by their assessed zones and reports validation status, signing details, and associated findings.
Zone status
| Status | Meaning |
|---|---|
| Secure | Validation was reported as successful for the assessed zone. Review any additional hardening findings. |
| Insecure | No validated DNSSEC protection was established for the zone or delegation. This is different from a broken signature. |
| Bogus | The signed data or trust chain failed validation. Investigate promptly because validating resolvers can reject it. |
| Error | Inspection could not establish the state. Read the detailed lookup or validation failure. |
Some error responses explicitly indicate missing delegation or signing records. SSLBoard classifies those as effectively unsigned rather than grouping them with confirmed broken signatures. A general lookup error remains an assessment failure.
Findings you may see
Broken validation findings include expired signatures, signatures not yet valid, a parent DS record that does not match, missing DNSKEY or RRSIG records, and invalid signatures. These point to different parts of the signing and delegation process, so preserve the specific finding when asking your DNS provider for help.
Hardening findings include deprecated signing algorithms, weak keys, and reliance on SHA-1-only DS digests. Signature-expiry risk can warn that otherwise working signing needs operational attention.
An NSEC zone-walking finding means denial-of-existence records expose names to enumeration. It does not mean the DNSSEC signatures failed. Assess information exposure separately from signature validity; public DNS names should not be treated as secrets.
Fix and verify
For a broken zone, coordinate with the authoritative DNS provider and registrar so that signing keys and parent delegation records agree. Avoid changing either side blindly during a rollover. For an unsigned zone, plan deployment as a complete signing-and-delegation change.
Retest after the relevant DNS changes are visible. Confirm the zone status and the specific findings, and verify resolution through validating resolvers. A successful DNSSEC result authenticates DNS data in scope; it does not validate the web certificate or prove application security.
The DNSSEC introduction and requirements explains its authentication and integrity guarantees, including the fact that DNSSEC does not make DNS data confidential.