What does the DNSSEC status in RDAP mean?

What problem does it solve?

Standard DNS tells a resolver where a domain should point, but the original protocol did not prove that the answer was authentic. DNSSEC creates a chain of signatures from the DNS root through the domain’s registry and authoritative DNS provider.

A validating resolver checks this chain before accepting an answer. If signatures are missing, altered or do not connect to the parent delegation, the resolver can reject the response rather than silently trusting it.

What “signed” means in RDAP

RDAP can report whether secure delegation data is present at the registry. That is a useful signal, but it is not a complete validation. A configuration can be published and still be broken—for example, if the registry’s DS record no longer matches the DNS provider’s key.

Domain Readout labels this field as a registry-published signal. If the record says “Signed”, it means secure delegation is reported in RDAP. If it says “Not published”, the registry did not include enough data for the tool to make that statement. Neither label checks every DNS response in real time.

Secure delegation, zone signing and validation

These are related but different ideas. A DNS zone can be signed at the DNS provider without a matching DS record at the registry. In that case, the chain of trust is not complete. Conversely, a stale DS record at the registry can point to a key the DNS provider no longer serves, causing validation failures for users whose resolvers enforce DNSSEC.

To confirm operational health, use a dedicated DNSSEC validator that follows the chain from the root, checks the parent DS record and validates the current DNSKEY and response signatures. An RDAP lookup should be treated as the registration-side starting point.

What DNSSEC does not do

• It does not encrypt DNS queries or website traffic.
• It does not replace HTTPS certificates.
• It does not prove that a website itself is honest.
• It does not stop every form of domain or account takeover.

Operational caution

DNSSEC should be enabled only when the registrar and DNS provider are coordinated. A stale DS record can make an otherwise healthy domain fail for validating users. Monitor the chain after key rotation, nameserver changes and DNS-provider migrations.

Before moving DNS providers, confirm who will remove or replace the DS record and in what order. The safe sequence depends on both providers' key-management processes. If a signed domain suddenly stops resolving, compare the registry delegation with the active DNS keys immediately.