Readiness check · Harden lane · weight 3

DNSSEC signed

A DS record for the registrable domain is published in the parent zone.

Observed on: 8%
Top 1K sites: 9.2%
Top 1M band: 8.4%
Not measured: 209

Why it matters

DNSSEC lets resolvers verify that DNS answers for your domain have not been altered in transit.

How to fix it

Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.

How we check

A DS record for the registrable domain is published in the parent zone.

Observed: DNSSEC delegation (DS record) present.

Not observed: No DS record found.

Limit: Read from public DNS at the time of the check; records may have changed since.

Stack-specific steps

Cloudflare: Enable DNSSEC in DNS > Settings and add the DS record at the registrar.
Amazon Route 53: Enable DNSSEC signing for the hosted zone and establish the chain of trust at the registrar.

By popularity band

Chrome UX Report band	Observed	Measured
Top 1K	9.2%	459
Top 5K	8.9%	2,093
Top 10K	7.1%	2,517
Top 50K	7.9%	18,631
Top 100K	8.6%	5,273
Top 500K	6.9%	5,356
Top 1M	8.4%	5,557

Categories most likely to do this

Categories least likely

By stack

Sitecore16%
Webflow15%
Astro13%
PrestaShop13%
Adobe Experience Manager on Amazon CloudFront12%
Drupal12%
Adobe Experience Manager11%
Drupal on Cloudflare11%
Nuxt on Amazon CloudFront11%
Nuxt on Cloudflare11%
Next.js on Google edge11%
Magento / Adobe Commerce9.6%
Next.js on Cloudflare9.5%
Next.js on Vercel9.4%
Nuxt9.2%
Angular7.8%
Next.js7.4%
Next.js on Fastly6.5%
Shopify6.5%
WordPress on Amazon CloudFront6.2%
WordPress6.1%
Next.js on Amazon CloudFront5.7%
WordPress on Cloudflare5.3%
Next.js on Akamai4.7%
Blogger4.3%

By provider

Popular sites where we observed this

Sources and guides

Guide: Website Uptime Readiness: Prepare Before Traffic Arrives Check your own site