CAs Must Validate DNSSEC (Since 15 Mar 2026): Broken DNSSEC Now Blocks Certificate Renewal

Short answer: Since 15 March 2026 every public CA must validate DNSSEC on its CAA and domain-validation lookups (CA/Browser Forum ballot SC-085), and a validation error is never permission to issue. A domain with a broken DNSSEC chain, usually a DS record left behind after a DNS host move, can't get or renew any certificate for its website, mail server or MTA-STS host. Domains without DNSSEC are not affected.

WhoCA/Browser Forum, IETF and IANA
Statusconfirmed
Dates
  • 2025-06-18: CA/Browser Forum adopts ballot SC-085v2: validate DNSSEC (when present) for CAA and domain-validation lookups
  • 2025-10-13: S/MIME ballot SMC014 adopted: the same rule for CAA checks on S/MIME certificates
  • 2025-11: RFC 9905: stop signing DNSSEC zones with SHA-1 (algorithms 5 and 7); resolvers that follow it treat them as unsigned
  • 2026-02-16: Ballot SC-094: for email-based validation, DNSSEC is a must only on the CNAME, CAA and TXT lookups that find the domain
  • 2026-03-03: DigiCert starts validating DNSSEC
  • 2026-03-15: SC-085 and SMC014 take effect: every public CA validates DNSSEC back to the IANA root
  • 2026-09-07: Ballot SC-100: the DNSSEC rules move to Baseline Requirements section 4.2.2.2
  • 2026-10-11: Root zone key KSK-2024 becomes active; resolvers that only trust KSK-2017 fail validation
  • 2027-01-11: IANA plans to revoke the old root key KSK-2017
  • 2027-03-15: Maximum certificate validity drops to 100 days, so renewals (and these DNSSEC checks) come twice as often

Who is affected

Any domain with DNSSEC turned on (a DS record at the registrar) whose chain is broken: a DS left over from the previous DNS host, signatures the DNS host stopped refreshing, a key rollover gone wrong, or a DNS host that returns an error for CAA queries. Issuance and renewal fail at every public CA, for the website, the mail server certificate (ports 25, 465, 587, 993) and the MTA-STS policy host. Most domains notice only at their first renewal after March 2026, because certificates issued before then could last up to 398 days. Domains without DNSSEC are not affected.

What you will see

Check your setup today

  1. Run our checker: the DNSSEC row validates the chain through 1.1.1.1 and shows the resolver's reason, and the CAA row tests the lookup every CA makes before it issues.
  2. By hand: dig CAA example.com @1.1.1.1, then dig +cd CAA example.com @1.1.1.1. SERVFAIL on the first and an answer on the second means DNSSEC is the cause.
  3. Let's Encrypt recommends DNSViz to see which link in the chain is broken (DS, DNSKEY or signatures).

How to fix it

  1. DS left from a previous DNS host: delete it at the registrar, or replace it with the DS your current host shows. Our checker prints the replacement DS when the old one doesn't match the zone's key.
  2. Moving DNS hosts: Cloudflare's order is remove the DS, wait for its TTL to expire (often 24–48 hours), change the nameservers, then turn DNSSEC on again and add the new DS.
  3. Signatures expired or missing: ask the DNS host to re-sign the zone, or delete the DS to go unsigned until they do. An unsigned (insecure) domain can get certificates again right away.
  4. Zones signed with algorithm 5 or 7: roll to 13 (ECDSAP256SHA256) or 8 (RSASHA256), the algorithms RFC 9904 recommends.
  5. CAA lookups that error while DNSSEC is fine: ask the DNS host to answer CAA queries (an empty answer is fine), or move DNS. Then retry the renewal and reload the services that use the certificate.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Related pages

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other upcoming changes