dnssec-invalid
Your DNSSEC validation is failing
By Jose Pollman · Published
How it appears in a report
"result-type": "dnssec-invalid"What it means
Your DNS records failed DNSSEC validation. DANE depends entirely on DNSSEC, so senders could trust nothing about your domain and refused the session.
Your mail server. This is your own receiving setup. The report describes senders failing to reach your MX, so the certificate, policy or DNS record at fault is yours to fix.
Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.
Why it happens
Usually an expired signature or a DS record that no longer matches after a key rollover. DNSSEC signatures expire on their own schedule independently of the records themselves, so a zone that stops being re-signed breaks without anyone changing anything.
How to fix it
- Run your domain through a DNSSEC validator to find which record is failing.
- Check whether signatures have expired — the most common cause, and it happens on a timer rather than on a change.
- After a key rollover, confirm the DS record at your registrar matches your current signing key.
- This reaches well beyond mail: a domain failing DNSSEC is being rejected by every validating resolver, for every service.