Network & Infrastructure / DNS, DNSSEC & Service Discovery
DNSSEC DS mismatch after an unsynchronized signing change
A signed zone returns SERVFAIL through validating resolvers while direct authoritative queries appear normal. The parent's DS may no longer match the zone's active trust path.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Collect the parent DS set, child DNSKEY records, signatures and validator diagnostic output. Check algorithm and digest compatibility, time validity and which key actually signs the relevant key set.
Explain the result
DNSSEC validates a chain from parent delegation to child keys and signed data. Ordinary authoritative answer availability cannot establish that this cryptographic chain remains valid.
Plan the fix
Follow the signing system's documented recovery or rollover procedure with the parent-zone owner. Avoid turning off validation across the organization to mask one broken delegation.
Check the result and rollback
Verify validation from independent resolvers and preserve evidence through cache expiry. Restore the previous valid signing state when supported if the new chain cannot be completed safely.