DNSSEC for macrumors.com - missing DS records

[vom]

Hello,

Looks like macrumors.com is signed, but DS records aren't published. I get messages like this on my DNS server at home:

May 13 13:25:12 ice named[29974]: validating forums.macrumors.com/A: no valid signature found
May 13 13:25:15 ice named[29974]: validating forums.macrumors.com/AAAA: no valid signature found

Is this a known issue ? Maybe it's currently in a testing state before you "pull the trigger" and publish DS ?

DNSViz output:
https://dnsviz.net/d/forums.macrumors.com/Xrwtsw/dnssec/

 

[arn]

thanks. will look into this

 

[vom]

thanks. will look into this

Good deal. Looks like you guys are on Cloudflare, I cherry picked some other domains with the same error, and it looks like a common aspect is Cloudflare. Looks like Cloudflare makes it very easy to "turn on" DNSSEC, but to really make it work the DS records must be entered into your registrar. This process is different for each registrar, but Cloudflare has links to most of the top ones on how to do this:

Setting up DNSSEC in Cloudflare

DNSSEC adds a layer of authentication on top of your DNS. To configure DNSSEC, you first enable it in the Cloudflare dashboard and then add a DS record at your domain registrar. Overview Step 1 - ...

support.cloudflare.com

 

[samwa3]

but to really make it work the DS records must be entered into your registrar

would be creepy if it'd work without doing that

 

[vom]

would be creepy if it'd work without doing that

Hah, indeed. In Soviet Russia DNS signs YOU...

 

[arn]

check it now

 

[vom]

check it now

Yep looks good now. Thanks !