Fixing SERVFAIL from DNSSEC validation failures

When a zone is DNSSEC-signed but the chain of trust is broken, validating resolvers (including 8.8.8.8 and 1.1.1.1) returnSERVFAIL for everything in the zone — MX, A, the lot. Mail and web both stop for a large share of the internet.

What it means

DNSSEC works only if the DS record in the parent zone matches your active DNSKEY, and yourRRSIG signatures are current. Break any link and validators treat the answers as forged (“bogus”).

Why it happens

The usual causes are a key rollover where the DS at the registrar was not updated to match the new key, expired RRSIG signatures, or a zone that was unsigned while its DS record was left in place at the parent.

Diagnose it

Use the DNSKEY, DS and RRSIG tools together: confirm the key tags in your DS match a published DNSKEY, and that the RRSIG validity windows have not expired.

Fix it

1. If a rollover went wrong, update the DS record at your registrar to match the current DNSKEY (key tags must line up).

2. If signatures expired, re-sign the zone so RRSIGs are current, and fix whatever stopped automatic re-signing.

3. If you meant to turn DNSSEC off, remove the DS record at the registrar first, then unsign — never the other way round.