How to fix DNSSEC (DS records) at Cloudflare Registrar

The DS record at your registrar tells the world your zone is DNSSEC-signed, and by which key. When it goes stale — classically after switching DNS providers — validating resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, most ISPs) return SERVFAIL and your site goes dark for those users while everything looks fine on your end.

⚠ Switching DNS providers on a DNSSEC-signed domain? Remove the DS record (or disable DNSSEC) at the registrar FIRST, and keep the old zone signed until the DS TTL has fully expired — changing nameservers while the old DS is cached makes validating resolvers return SERVFAIL (per Cloudflare's DNSSEC documentation).

Turning DNSSEC on (managed)

One-click and free: Manage Domains → your domain → Manage → Configuration → Enable DNSSEC (or from the zone's DNS Settings page). Cloudflare submits the DS to the registry itself — you never hand-enter DS values.

Fixing a broken (bogus) chain

1. Confirm the break: our DNSSEC checker (or DNSViz) shows whether the DS at the registry matches the keys your DNS provider is actually signing with.
2. If you recently changed DNS providers: Cloudflare Registrar manages the DS record itself — disable DNSSEC in the dashboard, and re-enable it once the new DNS provider's signing is active.
3. If the DS is right but signatures expired, the fix is at your DNS provider (re-signing), not the registrar.

Cloudflare Registrar supports removing the DS record while keeping the domain.

⚠ Disable DNSSEC in the same place before moving DNS away from Cloudflare.

⚠ Cloudflare's own warning: if you change nameservers before the old DS record's TTL has expired at the parent zone, validating resolvers return SERVFAIL — remove the DS/disable DNSSEC first and keep the zone signed until the DS TTL has fully expired.

Steps verified against Cloudflare Registrar: DNSSEC and related Cloudflare Registrar docs on 2026-07-14.