Security
DNSSEC troubleshooting: is it the signatures?
Step 1: check whether DNSSEC is the cause#
Run the failing query twice, the second time with +cd (checking disabled, RFC 4035 section 3.2.2). Replace NAME with the name that fails.
dig @1.1.1.1 NAME A
dig @1.1.1.1 NAME A +cd| Plain query | With +cd | It is |
|---|---|---|
SERVFAIL | NOERROR | DNSSEC: go to step 2 |
SERVFAIL | SERVFAIL | not isolated: read the EDE (step 2); DNSSEC not ruled out; servfail |
Step 2: read why#
Read the EDE line in the failing answer (RFC 8914). Here a zone broken on purpose:
Asks a deliberately broken zone for its address.
dig @1.1.1.1 dnssec-failed.org A; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 dnssec-failed.org A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19921
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for dnssec-failed.org.)
;; QUESTION SECTION:
;dnssec-failed.org. IN A
;; Query time: 105 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Sep 14 13:45:35 CDT 2026
;; MSG SIZE rcvd: 103
GO SERVFAIL, and an EDE line naming the reason
NO GO NOERROR with an address
DO resolver operator: Check validation is on, nothing validated the chain
| EDE | Means | Fix |
|---|---|---|
| 6, DNSSEC Bogus | a signature does not check out | find the link, step 3 |
| 7, Signature Expired | the signatures ran out | re-sign the zone |
| 9, DNSKEY Missing | the parent's DS matches no key the zone publishes | publish the key, or fix the DS |
| 10, RRSIGs Missing | records came back unsigned where signatures were expected | sign the zone, or remove the DS |
No EDE line in your dig output? Ask over DoH; the Comment field carries it:
curl -s -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=NAME&type=A'Step 3: find the broken link#
Check the chain with delv, which validates every link against its own root key and prints one verdict. On a Mac, use a current delv (brew install bind): the one macOS ships, 9.10.6, prints no crypto support.
delv @1.1.1.1 NAME Adelv prints | Means |
|---|---|
; fully validated | the chain is good; the problem is elsewhere |
;; resolution failed: failure | the chain is broken; add +rtrace to see each fetch |
; unsigned answer | the zone is not signed |
Or draw the whole chain: dnsviz.
See also#
- extended-dns-errors: every EDE code
- dnssec: how the chain works
- ksk-roll-2026: the root key roll
- SERVFAIL diagnosis: the EDE, the same question with +cd, then the chain