DNSSEC validation

The zone is DNSSEC signed. DS resource record is published.

DNSSEC.

Validating resolver.

Every 5 minutes.

None.

Yes, triggers an ERROR severity.

Purpose

When DNSSEC is enabled and the zone resource records are signed this check validates the RRSIG for each zone record set encountered during a check run.

Resource record set validation is the core function of DNSSEC. Validation is performed by the resolver by walking through the chain of trust from the root zones public key all the way down to the resource record sets RRSIG. The number of DNSSEC validations performed during a check run is directly dependent on the default zone content discovered and the number of additional resource records configured.

Customer configured Resource Records reports DNSSEC validation results for each record while the default configured resource records are reported in the DNSSEC metric.

The impact of a failed validation is severe enough to trigger an ERROR event on the Integrity metric.

Event severities and messages

DNSSEC validation successful for all X checked records.
Where “X” is the total number of validated record sets.

DNSSEC signature validates correctly.
Correct DNSSEC validation for general Resource Records

A/AAAA RRSIG validates correctly.
Since the A/AAAA Resource Records are counted as one they are checked together and the DNSSEC result is separated.

DNSSEC validation failure for name and type.
RRset for the specific name and record type has failed DNSSEC validation.

DNSSEC validation failure.
RRset has failed DNSSEC validation.

A/AAAA RRSIG validation failure.
One or both RRsets have failed DNSSEC validation.