I am trying to set DNSSEC on a domain I own and I ran into an issue. When checking the configuration with the following site, I get an error:
Broken chain of trust for dontgetlemon.eu - DNSKEY found at child, but no DS was found at parent. The child seems to use DNSSEC, but the parent has no secure delegation. Because of this, the chain of trust between the parent and the child is broken and validating resolvers will not be able to validate answers from the child.
I am not really sure what to do here, not much experience with setting this up.
Now, let me explain the setup a bit:
- The registrar for the domain is cloudns.net
- I am using cloudflare for the domain
- I have the cloudflare NS in my registrar's panel
- I added a TXT record for the DS and DNSKEY setup in the registrar's panel. My registrar does not have DNSKEY/DS/NSEC
I also checked my setup using these: http://dnsviz.net/d/dontgetlemon.eu/dnssec/ http://dnssec-debugger.verisignlabs.com/dontgetlemon.eu