DNSSEC off

Why it matters

DNSSEC signs the DNS records of your domain, so a resolver can tell a real answer from a fake one. For most domains it is free at the registrar, and it protects both your site and your mail.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It asks the DNS of the domain through Quad9 in Switzerland whether the answers are signed.

Common causes

• DNSSEC is not on by default at the registrar
• It was switched off when moving the domain and never switched on again
• The DNS is at another party than the registrar

How to fix it

1. Switch on DNSSEC at the registrar.
2. Is the DNS at another party? Switch it on there and pass the key to the registrar.
3. When moving the domain later, switch it off first and on again afterwards.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Your domain's address book is not signed". When everything is in order, the report says: "The domain is signed with DNSSEC".