PD Domain Radar can flag a change from a previously observed signed delegation to a current unsigned result. Use it as a prompt to review the domain’s DNSSEC configuration, rather than a complete validation of DNSSEC.

Enable the change rule

1. Open PD Modules → Domain Radar → Settings.
2. Review Flag when DNSSEC has been removed. It is off by default.
3. Save and allow successful registry checks to establish the domain’s previous state.
4. Inspect DNSSEC removed under Needs attention, using Notes only if useful.

The rule needs a previously stored signed state and a later result treated as unsigned. It does not flag every domain that has never used DNSSEC. A first scan cannot establish that DNSSEC was removed before monitoring began.

Check the actual configuration

Read the finding and checked time, then review the intended signing and delegation using your normal authorised DNS and registrar workflow. A registry signed indicator is not a cryptographic validation of the entire DNSSEC chain or proof that responses validate for all resolvers.

Missing signing fields in an otherwise accepted registry response can be interpreted as unsigned, so investigate before claiming a deliberate removal. A failed lookup does not establish the current signing state either.

Treat the finding as an observation

The stored snapshot is updated after the check. The removal note can therefore disappear on a later unchanged unsigned observation; this does not mean that DNSSEC was restored. Review the actual state before closing your investigation or reassuring a customer. Domain Radar does not create signing keys, publish delegation data or repair DNSSEC for you.

See the PD Domain Radar Blesta guide for related tasks, or explore PD Domain Radar.