How this check works
We query DNSKEY and DS records and, when neither appears, check for a zone’s nameservers. Published keys and delegation data are reported separately from cryptographic validation. Indeterminate results can reflect a leaf hostname, resolver failure or incomplete delegation data.
Two sides of the delegation
The zone publishes DNSKEY records; the parent zone publishes a DS record linking to the signing key. Changing DNS providers without updating that relationship can make a signed domain fail at validating resolvers.
Publication is not validation
Enabled here means key and delegation records were observed. We do not cryptographically validate the complete chain. A resolver's AD flag is recorded as a hint, not used as independent proof.
Common questions
Why is a subdomain indeterminate?
A hostname may inherit the security of a parent zone and have no separate DNSKEY or DS records. Absence at that hostname alone does not prove DNSSEC is disabled.
Should I immediately add a DS record?
Use the exact values and activation sequence provided by your DNS host and registrar. An incorrect DS can break DNS resolution.