# Domain dark after DNSSEC or a nameserver change

> The domain stopped resolving for many visitors after a nameserver move or turning on DNSSEC. Find the DS record that no longer matches.

Source: https://veldhost.eu/docs/dnssec-broke-my-domain

Last verified: 2026-11-13

Your domain worked, then right after you changed its nameservers or switched DNSSEC on, it stopped resolving: browsers say the site cannot be found, and mail stops arriving. Often it works for some people and not for others. That pattern points at DNSSEC.

## Why it happens

With DNSSEC, the registry holds a **DS record**: a fingerprint of the key the zone is signed with. Resolvers that check signatures compare the two. If the DS at the registry does not match the DNS that now answers, they do not fall back to an unsigned answer: they refuse the domain. Resolvers that do not check keep working, which is why it fails for some visitors only.

The DS goes out of step in a few ways:

- You moved the domain **to** veldhost while your old provider's DS was still at the registry. It vouches for keys we do not hold.
- You moved the domain **away** from veldhost while our DS was still there.
- You added a DS at your registrar that does not match our key (an old record, or a typing mistake).
- You switched nameservers **before** resolvers had forgotten a DS you had just removed.

## Fix it

### 1. Read the domain's DNSSEC state

Open [Domains](https://manage.veldhost.eu/portal/domains) → your domain and look at **DNSSEC**:

| It says | What it means |
|---|---|
| **DNSSEC mismatch** | "The DS record at the registry doesn't match the key we sign this zone with, so validating resolvers will refuse to resolve it." |
| **Stale DS** | There's a DS at the registry, but we do not sign this zone: left over from a previous setup. Registered with us? Choose **Fix DNSSEC**: we remove our old DS. |
| **DNSSEC active** | Signed and matching. DNSSEC is not your problem; see [My domain doesn't open my site](https://veldhost.eu/docs/domain-not-resolving). |
| **DNSSEC not activated** / **No DNSSEC** | No DS that could break the domain. Look elsewhere. |

For a domain registered elsewhere whose DNS is here, the same section says **The DS record at your registrar does not match** when it is wrong.

### 2. Moved the domain to veldhost: remove the old DS

The move wizard warns about this as **A DNSSEC record is still at the registry**. Sign in where the domain is registered and delete the DS record (often under "DNSSEC"). The domain recovers as resolvers drop the old record. Once it works, you can switch DNSSEC on again from the domain's **DNSSEC** section; see [DNSSEC](https://veldhost.eu/docs/dnssec).

### 3. A DS that does not match our key: replace it

If the page shows **DNSSEC mismatch** or **The DS record at your registrar does not match**, it lists the DS record to use. Replace the old record at your registrar with exactly that one. Registered with us? When every DS at the registry is ours, choose **Fix DNSSEC** under **DNSSEC** on the domain's page: we put the DS for our current key there, or remove our old one if we no longer serve the domain. When one is another provider's (your new provider's, for example), the page says so and changes nothing, because replacing a DS that is right would take the domain dark; finish the move at that provider, or contact support if you don't recognise it.

### 4. Moved the domain away from veldhost

For domains registered with us, the portal refuses this move while DNSSEC is active ("Turn DNSSEC off for this domain first…"). **Prepare to move away (turn DNSSEC off)** withdraws our DS and starts the wait. If you then confirmed you wanted to switch anyway before the wait was over, resolvers may still hold our old DS until the time the message showed. It clears by itself at that time. To avoid a gap altogether, publish your new provider's DS first (**My DNS provider gave me a DS record**); see [Change a domain's nameservers](https://veldhost.eu/docs/nameservers).

Registered elsewhere, and DNSSEC was on with us? Remove the DS at your registrar, or replace it with your new provider's.

> **Note:** Removing or replacing a DS does not fix the domain at once. Resolvers keep the old record until it expires, so allow up to a day (the move wizard asks you to wait a day for the same reason). When you turn DNSSEC off for a domain registered with us, its page shows the exact time it is safe to move.

## Still stuck?

Ask your AI assistant to run `get_domain_registrar` for the domain: it compares the registry with public resolvers and reports the true DNSSEC state. Before switching DNSSEC on, `probe_domain_dns` checks that every nameserver answers the same. Then [contact us](https://veldhost.eu/contact) with the domain name.

## Related

- [DNSSEC](https://veldhost.eu/docs/dnssec)
- [Change a domain's nameservers](https://veldhost.eu/docs/nameservers)
- [Move your DNS to veldhost](https://veldhost.eu/docs/move-your-dns-to-veldhost)
- [Connect your own domain](https://veldhost.eu/docs/connect-your-domain)