Domain not resolving after registrar transfer, suspect DNSSEC issue

Question

I just transferred my domain to a new registrar and pointed the nameservers back to my hosting provider. The transfer completed a few hours ago, but the domain is completely unreachable now. I've double-checked that the nameserver records at the new registrar are correct. A friend mentioned it could be a DNSSEC problem, but I'm not sure how to check that. The old registrar had it enabled, and I'm not sure if the new one does. How can I troubleshoot this to see if DNSSEC is causing the resolution failure?

admin · Accepted Answer

Yes, this is almost certainly a DNSSEC validation failure caused by the domain transfer. When you moved registrars, the cryptographic keys (DS records) stored at the domain registry likely became invalid because your new registrar hasn't published new ones. DNS resolvers that validate DNSSEC will then reject your domain as insecure. First, verify the failure using a DNS lookup tool with DNSSEC checking enabled:

dig +dnssec yourdomain.com @8.8.8.8

Look for a `SERVFAIL` status or `ad` flag missing in the response. To confirm, test against a non-validating resolver:

dig yourdomain.com @1.1.1.1

If the second command works, DNSSEC is the culprit. Log in to your new registrar's control panel and check their DNSSEC management section. You have two solutions: either disable DNSSEC entirely at the new registrar if they don't support it, or properly configure it by generating new keys and submitting the current DS records to your new registrar to publish at the registry level.

Domain not resolving after registrar transfer, suspect DNSSEC issue

Who Is Online