DNSSEC
DNSSEC check
DNSSEC signs DNS answers so they can’t be silently tampered with. We check the chain of trust and the signature’s expiry.
Why check this
An expired signature is the classic “Saturday outage”: the DS record is there but the signature isn’t, and the zone disappears entirely for validating resolvers. It’s nearly impossible to notice on your own without dedicated monitoring.
Frequently asked
What is DNSSEC in plain terms?
A digital signature for DNS answers: a resolver can verify the record wasn’t tampered with along the way.
What’s the risk of enabling DNSSEC without monitoring?
Signatures expire. Forget to renew them and the zone becomes unreachable for part of the internet, and without monitoring, you’ll only find out from complaints.