The chain of trust
DNSSEC signs DNS answers so resolvers can tell they were not forged. The zone publishes DNSKEY records and signs its records with them. The parent zone (for example .com) publishes a DS record, a hash of the zone's key-signing key. Resolvers follow the chain from the root down.
If the DS record does not match any key, validation fails and validating resolvers return SERVFAIL: the domain disappears for most of the internet. The checker detects this by asking again with checking disabled.
Switching it on
Turn on signing at your DNS host, then add the DS record it gives you at your registrar (many do both automatically when they are the same company). Algorithm 13 (ECDSA P-256) is the usual choice.
Questions
- What does island of security mean?
- The zone has keys but the parent has no DS record, so resolvers treat it as unsigned. Add the DS record at the registrar.