dnssec.algorithm Reviewed July 2026

Quick fix

Confirm the authoritative DNS provider supports a modern DNSSEC algorithm.

What this finding means

The scanner inspects published DNSKEY and DS algorithms and flags algorithms that current operational guidance considers obsolete or unsuitable. The result does not attempt cryptanalysis; it identifies policy-level algorithm risk.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Deprecated DNSSEC algorithms can reduce cryptographic assurance and create interoperability or policy failures.

Step-by-step fix

Where to make the change

  • The authoritative DNS provider and, for DNSSEC delegation, the domain registrar.
  • The cloud, CDN, SaaS, or hosting tenant referenced by the affected DNS record.

Remediation procedure

  1. Confirm the authoritative DNS provider supports a modern DNSSEC algorithm.
  2. Introduce the new key and DS material with an overlap period.
  3. Wait for TTL and registrar propagation before retiring the old algorithm.
  4. Document the rollover procedure and emergency recovery contacts.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Trace authoritative DNS
dig +trace example.com

Inspect common records
dig +short A example.com
dig +short AAAA example.com
dig +short CNAME host.example.com

Verify the fix

  1. Run: dig +dnssec DNSKEY example.com
  2. Inspect algorithm numbers in DNSKEY and DS records.
  3. Validate the chain with delv after the rollover.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Changing DNSKEY without updating DS.
  • Performing an algorithm rollover without overlap.
  • Using a strong key while leaving an obsolete DS active.

Authoritative references