Check DNSSEC

Check DNSSEC

DNSSEC is activated fully automatically in FireStorm, you don’t have to do anything, it all happens in the background.

New domain: DNSSEC not active yet?

For a newly registered domain or a domain that has just been transferred to FireStorm, you do not need to activate DNSSEC yourself or open a ticket. We sign the domain automatically on our name servers. The registry then takes over the key on its own after checking it for a few days. For .ch and .li domains this usually takes 3 to 5 days after registration.

During this time it is normal that the Whois lookup still shows DNSSEC: N or that a checker reports DNSSEC as inactive. You do not need to do anything. If DNSSEC is still not active after 7 days and the domain uses our name servers, please contact support.

Right after activation or a change, a DNSSEC checker may temporarily show errors, for example no response to DNSKEY queries or a CDS RRset that is not signed. This is normal: the activation is picked up automatically by the registry via the CDS record, and depending on the registry this can take a few days. In that case, check your domain again after a few days before you worry or contact support.

You can have DNSSEC for your domain name checked online at VERISIGN. Open the link https://dnssec-analyzer.verisignlabs.com and enter your domain name in the search field. Afterwards the DNSSEC settings will be checked thoroughly. Now make sure that the green checkbox is displayed everywhere for your domain name. If DNSSEC is not configured correctly, some ISPs may be able to display the website and others may not (those who check the DNSSEC key). In this case you should contact your domain registrar.

Info: The domain names registered with FireStorm are automatically checked by us on a regular basis to ensure that DNSSEC is working properly.

This is what a successful DNSSEC check should look like: