Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTo understand a Zonemaster result, start with the test case and its exact message tag, then check what that test measures. A severity label or a missing message is not enough to tell you whether DNSSEC validated, a parent delegation is consistent, or a nameserver is answering authoritatively.
How to read a Zonemaster result
Record the test name, message tag, severity, and any nameserver or IP address shown. The test name tells you which check ran; the tag identifies the condition it reported. Look up that tag in the specification for the matching test and, where possible, the version used by your Zonemaster deployment. Different tests can use similar-looking labels for different checks.
As an Amazon Associate I earn from qualifying purchases.
Severity is useful, but it is not a substitute for the message meaning. In the cited delegation specifications, a test outcome is failed when it has an ERROR or CRITICAL message, a warning when it has a WARNING without an ERROR or CRITICAL, and otherwise passes. These are documented defaults: an Engine profile can override severity, so check the profile used for the run before treating a level as universal.
Keep any server or address named in a message. If one server behaves differently from another, the finding may describe that server’s response rather than a uniform condition across the zone.
#1 Best Overall
What DNSSEC DS and DNSKEY findings mean
The parent zone publishes a DS record for a child zone. That DS must match a DNSKEY in the child’s DNSKEY record set, and the referenced key must sign the child’s DNSKEY set. For the match to support the chain, the DS-referenced DNSKEY must also have the zone-key flag set.
Use the exact DNSSEC02 tag to identify which part of this relationship failed:
Rank #2
| Message tag | What it means | What to check |
|---|---|---|
DS02_NO_DNSKEY_FOR_DS |
The DS refers to a key tag that is absent from the child’s DNSKEY set. | Check whether the parent DS is stale or the intended DNSKEY is missing from the child. |
DS02_NO_MATCH_DS_DNSKEY |
A DNSKEY with the relevant key tag exists, but its algorithm or digest does not match the DS. | Compare the published DS and DNSKEY values, including the algorithm and digest. |
DS02_DNSKEY_NOT_FOR_ZONE_SIGNING |
The matching key does not have the zone-key flag set. | Check the DNSKEY flags and whether the parent DS refers to the intended key. |
DS02_NO_MATCHING_DNSKEY_RRSIG |
The DNSKEY set lacks a matching signature from the DS-referenced key. | Check the DNSKEY-set signature and the key expected to sign it. |
DS02_RRSIG_NOT_VALID_BY_DNSKEY |
The matching signature does not validate against the DNSKEY. | Check the signature against the published key and the DNSSEC configuration that produced it. |
DS02_DNSKEY_NOT_SEP |
The cited DNSSEC02 specification classifies this as NOTICE; it is not the same finding as a missing zone-key flag. | Read the notice in the context of the full DNSSEC output rather than treating it as an error. |
DNSSEC02 has prerequisites: it terminates if no DS is found at the parent or no DNSKEY is found in the child. In either case, no DNSSEC02 message is not evidence that this test validated the chain. Read the complete output, including other DNSSEC tests, and distinguish a test that passed from one that could not perform its check.
What delegation and nameserver findings mean
Delegation checks address different questions: whether parent servers agree on the child delegation, whether enough nameserver names and addresses are present, whether names share IP addresses, and whether servers answer authoritatively. Do not treat one of these findings as proof of another.
Parent servers disagree about the child delegation
BASIC01’s B01_INCONSISTENT_DELEGATION means nameservers for the parent zone returned inconsistent delegation information for the child. The message identifies the parent, child, and nameserver list it received. Compare the child’s NS delegation as seen from each parent server, then reconcile the results with the delegation intended at the registrar or registry.
Too few nameservers or missing address families
DELEGATION01 counts nameserver names and names with IPv4 or IPv6 addresses separately, using both the parent-delegation view and the child-zone view. The suffix in the tag matters: CHILD identifies the child-data view and DEL the delegation view.
| Tag family | What the finding checks |
|---|---|
NOT_ENOUGH_NS_CHILD / NOT_ENOUGH_NS_DEL |
Fewer than two nameserver names are present in the child or delegation view, respectively. |
NO_IPV4_NS_CHILD / NO_IPV4_NS_DEL |
IPv4 address availability in the child or delegation view, respectively. |
NO_IPV6_NS_CHILD / NO_IPV6_NS_DEL |
IPv6 address availability in the child or delegation view, respectively. |
These are distinct checks: a finding about nameserver count does not itself describe IPv4 or IPv6 availability. Inspect the exact tag and view before changing records.
Different names resolve to the same IP address
DELEGATION02 checks whether distinct nameserver names reuse an IP address, in both the parent delegation and child view. Its repeated-IP findings are ERROR by default in the specification. Two different names therefore do not necessarily represent separate IP endpoints; inspect the addresses and the view named in the result.
Best Value
A nameserver does not answer authoritatively
DELEGATION04 checks whether nameservers answer SOA queries with the authoritative-answer (AA) bit set. It queries addresses obtained from both parent and child views over TCP and UDP. A failure indicates an authoritative-service or configuration problem to investigate. A transport disabled for testing is excluded from evaluation by the specification.
A nameserver hostname is a CNAME
DELEGATION05 checks that a nameserver hostname does not resolve to a CNAME. In the cited specification, NS_IS_CNAME has default severity ERROR, UNEXPECTED_RCODE WARNING, and NO_RESPONSE DEBUG. These are not interchangeable: a nonresponse is not confirmation of a CNAME violation. Check the separate connectivity findings as well.
A referral exceeds the legacy UDP size condition
DELEGATION03 tests referral size against the legacy condition of a 512-octet non-EDNS UDP packet. In the cited specification, an oversized referral is a WARNING and a passing size message is INFO. This is a referral-size finding, not a DNSSEC validation error.
A practical way to troubleshoot the result
- Capture the result details. Note the domain, Zonemaster version if shown, test case, exact message tag, severity, and any named nameserver or IP address.
- For delegation findings, compare views and servers. Compare the child’s NS data returned by each parent server with the child’s own NS record set. Then check the relevant nameserver-count and address-family tags, reused IP addresses, and authoritative SOA responses.
- For DNSSEC findings, compare the chain components. Check parent DS records against child DNSKEY key tags, algorithms, digests, flags, and signatures on the DNSKEY set. Use the specific tag to locate the mismatch rather than making a change based only on a generic DNSSEC error label.
- Check whether the test could run. Look for its prerequisites and scope. For DNSSEC02, establish whether a parent DS and child DNSKEY were present; treat an omitted finding as unreported, not automatically passed.
- After changing DNS, allow for publication and caching, then run the check again. The time required depends on the records and caches involved; these findings do not establish a universal propagation interval.
Why version and test scope matter
Zonemaster documentation includes versioned specifications as well as pages labeled “latest,” and an installation may use a different release or Engine profile. Match the message to the specification for the tested deployment where possible. Also account for each test’s boundaries: DNSSEC02, for example, does not report parent nameserver unresponsiveness or inconsistency, and it leaves nonresponsive or incorrect authoritative responses handled elsewhere. A clean result from one test is not a substitute for the other checks in the run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
