Five days of waiting
On 5 November 2026, we enabled DNSSEC for 13 domains registered through Cloudflare. On 9 November, all 13 still showed as pending, and public DNS queries through 1.1.1.1 returned no DS records for them. On 10 November, Cloudflare confirmed that all 13 were protected. Its documentation gives one to two days for automatic setup. Our checks show when the status changed, but they do not identify the cause of the delay.
What the DS record does
DNSSEC lets DNS resolvers verify that an answer comes from the domain’s signed DNS zone and has not been altered. Cloudflare signs the zone. A Delegation Signer (DS) record in the parent zone connects that signature to the DNS chain of trust. Without the DS record, the domain can still resolve, but resolvers cannot verify its answers through that chain.
Where to enable and check it
In the Cloudflare dashboard, open the domain and go to DNS → Settings → DNSSEC. For a domain registered with Cloudflare Registrar, Cloudflare handles submission of the DS record. For a domain registered elsewhere, check the registrar’s DNSSEC procedure and submit the DS values from Cloudflare there if required.
Read the public answer
dig @1.1.1.1 example.com DS +noall +comments +answerIf the dashboard still shows Pending, query the public DNS for the DS record. Replace example.com in the command above with the domain you are checking. A DS record in the answer shows that this resolver can see it. NOERROR with ANSWER: 0 means the query succeeded but returned no DS record. A timeout or SERVFAIL leaves the question open.
When to ask for help
Check the dashboard again. If the automatic setup stays pending beyond Cloudflare’s stated timeframe, share the affected domains, the activation date and the DNS query results with Registrar Support.
