DNSSEC is not enabled
sec_dnssec_missingShort answer
DNSSEC is not active for your domain. Turn on DNSSEC (zone signing) at your DNS provider, then add the DS record it gives you at your domain registrar. Both steps are needed; signing without the DS record at the registrar does nothing.
Why it matters
Without DNSSEC, a resolver has no way to tell a genuine answer from a forged one. An attacker who poisons a resolver's cache or sits on the network path can return a different IP address for your site or a different mail server for your domain. HTTPS still protects web visitors to a large degree, because the attacker also needs a valid certificate, but mail delivery and other services that rely on plain DNS are more exposed.
This is an informational check: the protection is real but narrower than most other checks on this page. It has no search ranking effect.
How Glimana detects it
Glimana asks a validating public resolver (Cloudflare 1.1.1.1 over DNS-over-HTTPS, Google 8.8.8.8 as fallback) for the A record of your registrable domain and reads the Authenticated Data (AD) flag in the answer. If the flag is set, the chain of trust from the TLD down to your zone is complete and the check passes. If it is not set, the problem is info; this includes zones that are signed but have no DS record at the registrar. If no answer was received, the result is Could not be measured.
How to fix it
Watch out
A DS record that does not match your zone takes the domain offline for every user of a validating resolver (they get SERVFAIL). Enable signing first, copy the DS values exactly, and before you change DNS provider remove the DS record at the registrar and wait for its TTL (often one to two days) or follow the new provider's DNSSEC migration procedure. Not every registrar or TLD supports DNSSEC; if the registrar panel has no DNSSEC option, ask them.
- Find the finding in Glimana. Open Security; this check is in the E-mail and DNS group, with the evidence from the last scan under its title. The same problem is listed under Issues › DNSSEC is not enabled.
-
Apply the fix on your platform.
Go to DNS › Settings and click Enable DNSSEC. Cloudflare shows the DS record (key tag, algorithm 13, digest type 2, digest). Add those values in the DNSSEC section of your registrar's panel. If the domain is registered with Cloudflare Registrar, the DS record is added for you.
Turn on DNSSEC or "zone signing" in the DNS provider's panel and copy the DS (or DNSKEY) values it shows. In the registrar's panel open the domain's DNSSEC settings and add them. When the registrar also hosts your DNS, this is often a single switch. Check with
dig +dnssec example.com A @1.1.1.1and look foradin the flags line. - Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
The DS record is published at the TLD and can take hours to appear; once dig shows the ad flag, press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.