DNSSEC not enabled — signing the records your email security rests on
Every email authentication decision is made by reading DNS. Without DNSSEC there is no cryptographic guarantee that the SPF or DMARC record a receiver read is the one you published.
This is a lower priority than getting DMARC to enforcement, but it is usually a one-click change at your registrar and it is a visible credential on a client-facing report.
How to fix it
- 1Check whether your DNS host supports one-click DNSSEC — most large providers now do.
- 2Enable signing, which generates the keys and publishes the DS record at your registrar.
- 3If the registrar and DNS host are different, copy the DS record to the registrar manually.
- 4Verify the delegation is signed and validating before you consider it done — a half-configured DNSSEC delegation breaks the domain outright.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored