DNSSEC is not enabled for the domain

What it is

DNSSEC is a signature on DNS answers. It lets a computer verify that the answer to “where is example.com” really came from you and that nobody changed it on the way. Your DNS server signs the zone with a key (a DNSKEY record), and a fingerprint of that key (a DS record) is stored at the domain registry.

We only looked at public DNS: whether the zone has a DNSKEY record. We do not check whether the chain of signatures up to the root is correct.

Why it’s a problem

Without DNSSEC a forged answer can be injected, for example by poisoning the cache at an internet provider. A visitor or a mail server then goes to the wrong address.

This is not an active leak. It is a missing layer of protection, which is why it is a recommendation.
DNSSEC does not encrypt anything and does not verify the content of your site. It protects only the authenticity of DNS answers.
DANE and some other mail protections build on this layer.

How to fix it

1. Turn on signing at your DNS host

At the provider that runs your DNS (your registrar, Cloudflare and others), look for a “DNSSEC” option. Once on, it shows the DS record data: key tag, algorithm, digest type and digest.

2. Add the DS record at the registry

If your DNS and your domain registration are in the same place, this often happens automatically. Otherwise enter the DS data in your registrar’s admin. A .cz domain is fine here: the registry CZ.NIC supports DNSSEC, including automatic DS updates from CDS/CDNSKEY records when your DNS host publishes them.

3. Verify

dig +short DNSKEY example.com
dig +short DS example.com

Both commands should return a non-empty result.

Careful when moving DNS

If you turn on DNSSEC and later move DNS elsewhere while the DS record stays at the registry, the domain stops working for everyone who validates signatures. Before changing DNS host, remove the DS record at the registry first, or carry the keys over.