Glossary
What is DNSSEC?
Uses digital signatures to verify the source of DNS responses and that they have not been altered.
For a signed DNS zone, DNSSEC allows answer signatures to be checked through a chain of trust reaching the parent zone. During activation or key changes, the DNS provider configuration and DS information at the registrar must agree. This validates DNS data; it does not encrypt DNS queries or web traffic.
Example
When changing DNS providers, the parent zone needs DS information matching the new signing keys. Leaving old DS information behind can cause validation failures.
Common issue
Receiving a DNS answer does not by itself prove that the DNSSEC chain of trust was validated. Record comparison in the DNS tool is not a dedicated DNSSEC validation report.