DNSSEC monitor
What it checks
A DNSSEC monitor checks the chain of trust for a signed domain: DNSKEY records, the parent zone's DS records, signatures, validating-resolver agreement and authoritative nameserver consistency. It uses the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9.
| Result | Meaning |
|---|---|
| Up | The chain is valid and nameservers are consistent. |
| Degraded | Validation passes, but the earliest signature expires within your warning period. |
| Down | Validation fails, the zone is unsigned, nameservers are inconsistent or the check cannot complete. |
Use this for domains that are expected to be signed. An unsigned domain is not a healthy DNSSEC result. For ordinary record resolution, use a DNS monitor.
Create it
- Open New monitor and choose DNSSEC.
- Enter a friendly name and the domain, such as
cloudflare.com, without a URL scheme or path. - Set Warn before signatures expire (days). The default is 7; the allowed range is 1–365.
- Choose the interval and available probe regions. New DNSSEC monitors start at 15 minutes; the built-in minimum is 5 minutes, subject to your plan's limits.
- Choose alert channels and click Create monitor.
DNSSEC monitoring is included in Free, Pro and Business. API and MCP access have their own plan requirements.
Read the result
The monitor's Details card shows the chain verdict, signed-zone and parent-DS status, resolver consensus, nameserver consistency, DNSKEY count and earliest signature expiry. Recent checks distinguish Degraded from Down.
A near-expiry warning can occur while the domain still resolves and its chain remains valid. Renew or investigate the signatures before they expire. Missing or failed observations are not proof of a healthy chain.
Alerts and troubleshooting
The normal alert settings apply, including failed-check thresholds, quiet hours, reminders and escalation. Signature warnings use the monitor's Degraded status; they are separate from the scheduled expiry-alert checkboxes for SSL and domain-registration monitors.
- Unsigned zone or missing DS: enable signing with the DNS provider and publish the correct DS record at the registrar.
- Resolver disagreement: investigate delegation, propagation and signing changes. Do not treat a successful record lookup as proof of DNSSEC validity.
- Nameserver inconsistency: check that authoritative nameservers agree on the zone and signatures.
- Check timeout: inspect the latest diagnostics and review the Advanced timeout/retry settings.
API and MCP
Use type: "dnssec", a domain in target and warn_days for the signature warning period. The API workflows include a complete request. MCP uses the existing create_monitor and update_monitor tools; see example prompts.