Skip to content
MtrXTools

EDE: 9 (DNSKEY Missing)

The DS record points to a key the zone does not have

Seen in dig (Extended DNS Errors), Cloudflare 1.1.1.1, Google 8.8.8.8

The parent zone has a DS record for this domain, but no matching DNSKEY (or no signatures) is found in the zone, so DNSSEC validation fails.

Common causes

  • The domain moved to a new DNS provider and the old DS record was left at the registrar.
  • DNSSEC was turned off at the DNS provider but the DS record was not removed (EDE 10, RRSIGs Missing).
  • A key rollover published a new DS before the new key was in the zone.

How to fix it

  1. Compare `dig DS example.com` with `dig DNSKEY example.com`: the DS key tag must match a published key.
  2. Remove the old DS record at the registrar, or replace it with the DS your current provider gives you.
  3. Wait for the DS record's TTL to expire, then test again with a validating resolver.
Compare the DS and DNSKEY records

Got a different message? Paste it into the error explainer.

Related errors

All 22 DNS errors