DS validation check

The zone has published DS resource records.

DNSSEC.

Randomly selected parent DNS server.

Every 5 minutes.

None.

High.

Purpose

Check whether the published DS resource record has been modified since it was first viewed.

 The DS resource record references a DNSKEY resource record by storing the key tag, algorithm number and digest of the referenced DNSKEY record. The DS key is published in the parent zone and is an important part of making the DNSSEC chain of trust work. If no DS key is found in the parent servers, the zone is effectively unsigned by DNSSEC.

The check validates that the DS resource record found on the parent DNS server when the check is run is identical to the record recorded during the monitoring setup. A failed validation will affect the DNSSEC validation of any of the zone content.

The check will also issue duplicate DS record notifications.

As the DS record contains information about the cryptographic algorithm used to sign the zone, the check will also issue alerts if an algorithm is found that is listed by IANA as Not Recommended or Must Not Be Used.

Event severities and messages

The response matches with the expected values.
Parent DS resource records match last configuration’s stored values.

Note! These warning messages can also be seen under ERROR events if DS records have been added or removed from the parent! Please read the message.

Multiple DS records published.
There are keys published in the parent zone that are or might be outdated. They should be removed. Be very careful and check the key-id’s to not removing the active key!

Multiple DS records with different algorithms published.
A zone should never be signed with multiple algorithms. That puts too much strain on the signings engine. The only time that it is ok to use multiple algorithms is when performing a roll-over to a new algorithm.

The algorithms RSASHA1, RSASHA1-NSEC3-SHA1 and RSASHA512 are not recommended for signing.
Replace the current signing algorithm with a new and better one.

Couldn’t find any DS records. The zone is unsigned.
The DS records appear to have been removed from the parent DNS server. If this is a legitimate action the monitored domain needs to be reconfigured, if not, someone is tampering with the domain. If this is a second level domain (third in some countries) the DS records are handled through the registrar and it could be that someone has gained access to the domain account.

The algorithms RRSAMD5, DSA, DSA-NSEC3-SHA1 and ECC-GOST must not be used for signing..
Replace the current signing algorithm with a new and better one.

Unrecognised records:
Someone has added DS records to the parent. This should only happen during a KSK key rollover. If this is a legitimate addition, please perform a Reconfigure to update the monitoring database. If not, someone could be tampering with the domain, possibly at the registrar level.

Missing records:
Someone has removed DS records from the parent. This should only happen after a KSK key rollover when removing outdated DS records. If this is a legitimate addition, please perform a Reconfigure to update the monitoring database. If not, someone could be tampering with the domain, possibly at the registrar level.

Parent name server responded with error code to DS type query.
Something isn’t working on the parent DNS server. Please refer to the Generic DNS response codes page.

Solutions, tips & tricks