If your domain isn’t loading or resolving properly, the cause might be a DNSSEC configuration mismatch. This guide explains what DNSSEC SERVFAIL errors are, why they happen, and how to fix them so your domain works normally again.
What Causes DNSSEC SERVFAIL Errors?
DNSSEC (Domain Name System Security Extensions) is a security feature that adds authentication to DNS responses. However, Ecenica hosting does not support DNSSEC, which means your domain needs to operate without it.
DNSSEC SERVFAIL errors typically occur when:
- DS records exist at your domain registry (the organisation that manages your domain extension like .uk or .com)
- But the corresponding DNSKEY records are missing from your nameservers
This mismatch causes DNS validation to fail, preventing your domain from resolving properly.
Common Situations
You might encounter this issue if:
- You’ve just registered a new domain and DNSSEC was automatically enabled
- You’ve transferred your domain from a provider that supported DNSSEC to Ecenica
- You’ve changed nameservers but old DNSSEC records remain at the registry
- DNSSEC was previously configured but incompletely removed
How Do I Know If This Is My Problem?
If you’re experiencing any of these symptoms, you likely have a DNSSEC mismatch:
- Your domain doesn’t load in web browsers
- You see “SERVFAIL” errors when checking DNS
- SSL certificates fail to generate or renew
- Email stops working
For Technical Users: Diagnostic Commands
If you’re comfortable using the terminal, you can verify the issue with these commands:
Check for DS records at the registry:
dig DS example.uk
This shows whether DS records exist at your domain registry.
Check for DNSKEY records on your nameservers:
dig DNSKEY example.uk +dnssec +cd
This checks if DNSKEY records are present on your nameservers.
Expected result: If DS records exist but no DNSKEY records are found, you have a DNSSEC mismatch.
How to Fix DNSSEC SERVFAIL Errors
To resolve this issue, the DS records need to be removed from your domain registry. Ecenica support can handle this for you.
Contact Ecenica Support
Submit a support request with the following information:
- Your domain name (e.g., example.uk)
- A brief description: “I’m experiencing DNSSEC SERVFAIL errors”
- Request: “Please remove DS records from the registry”
Our technical team will contact the registry on your behalf to remove the problematic DS records.
What Happens Next
- Removal process: Our team submits the removal request to the registry
- Processing time: The registry typically processes the request within 24-48 hours
- DNS propagation: Changes propagate across global DNS servers over the next 24-48 hours
- Resolution: Your domain will begin resolving normally as an “Insecure” (non-DNSSEC) domain
After the DS Records Are Removed
Once the DS records have been removed from the registry:
- Your domain will resolve normally without DNSSEC signing
- DNS queries will work without SERVFAIL errors
- SSL certificates will generate and renew successfully
- Your website and email services will function normally
Note: Some DNS resolvers cache old records, so it may take up to 48 hours for all systems worldwide to recognise the change.
Verifying the Fix
If you used the diagnostic commands earlier, you can run them again to confirm the DS records have been removed. You should see no DS records returned.
Understanding “Insecure” Domains
Your domain will now operate as “Insecure” in DNSSEC terms. This simply means your domain is not using DNSSEC signing—it’s the standard configuration for most websites.
This does not make your website insecure. Your site security still relies on:
- SSL/TLS certificates (the padlock in browsers)
- Secure hosting infrastructure
- Strong passwords and account security
- Regular software updates
Operating without DNSSEC is completely normal and does not affect your website’s security or functionality.
Frequently Asked Questions
Why doesn’t Ecenica hosting support DNSSEC?
DNSSEC requires specific nameserver configurations and ongoing management that aren’t compatible with our shared hosting platform. Most hosting providers operate the same way.
Will my website be less secure without DNSSEC?
No. DNSSEC is one layer of DNS security, but your website’s actual security comes from SSL certificates, secure hosting, and other measures that remain fully in place.
How long will it take to fix this issue?
Once we’ve submitted the DS record removal request, it typically takes 24-48 hours for the registry to process it, plus another 24-48 hours for full DNS propagation worldwide.
Can I prevent this from happening with future domains?
Yes. When registering new domains, make sure DNSSEC is not automatically enabled if you’re using Ecenica hosting. If you’re unsure, contact support before changing nameservers.
My domain still isn’t working after 48 hours. What should I do?
Contact Ecenica support with the results of your diagnostic checks (if you ran them) or simply let us know the domain is still not resolving. We’ll investigate further.
I’m transferring my domain to another provider. What should I do?
If your new provider supports DNSSEC, you can configure it after the transfer. If they don’t, ensure DS records are removed before or during the transfer process.
What if I want to use DNSSEC in the future?
You would need to move to a hosting provider that supports DNSSEC configuration, or upgrade to a service level where you have full DNS control (such as a VPS or dedicated server).
Will this affect my email?
Yes, DNSSEC SERVFAIL errors can prevent email from working. Once the DS records are removed and DNS propagates, your email will function normally again.
Need Help?
If you’re experiencing DNSSEC SERVFAIL errors, contact Ecenica support and we’ll remove the DS records from your domain registry for you.
