Fix DNSSEC SERVFAIL After Changing Nameservers
Published: 21 Aug, 2026

blog_EEGIatrJCNXsxN8Pqdmf0QY_thumb.jpg

Why Did Your Site Go Down After Changing Nameservers?

You updated your domain's nameservers to point to a new web host or Cloudflare. Your A records are correct, propagation seems complete on some checkers, yet your website suddenly throws a SERVFAIL or DNS_PROBE_FINISHED_NXDOMAIN error for most visitors. What happened?

In 90% of sudden post-migration DNS outages, the culprit is an orphaned DNSSEC (Domain Name System Security Extensions) record.

What Is an Orphaned DNSSEC Record?

DNSSEC adds cryptographic signatures to your DNS records to prevent spoofing and cache poisoning. When you enable DNSSEC, your domain registrar publishes a DS (Delegation Signer) record to the Top-Level Domain (TLD) registry (such as .com or .net).

When you switch your nameservers to a new provider:

  • The new DNS provider starts serving DNS records without the old provider's private signing keys.
  • The parent registry still holds the old DS record pointing to the previous provider.
  • Security-aware DNS resolvers (like Google 8.8.8.8 and Cloudflare 1.1.1.1) attempt to validate the cryptographic chain, detect a mismatch, and deliberately refuse to resolve your domain to protect visitors.

How to Verify if DNSSEC Is Breaking Your Domain

Before making changes, confirm that a DNSSEC validation failure is indeed causing the outage:

  1. Visit an online DNSSEC analyzer such as DNSViz.net or Verisign DNSSEC Analyzer.
  2. Enter your domain name and run the test.
  3. If the tool shows broken trust chains, red errors, or messages like No DNSKEY matches DS record, your issue is 100% confirmed.

How to Fix the DNSSEC Mismatch (Step-by-Step)

Step 1: Disable DNSSEC at Your Domain Registrar

The fastest way to restore website availability is to remove the old DS record from the registry:

  1. Log in to the account where you purchased your domain (Namecheap, GoDaddy, Porkbun, Google Domains/Squarespace, etc.).
  2. Navigate to your domain's DNS Management or Advanced DNS settings.
  3. Locate the DNSSEC section.
  4. Click Disable, Delete, or remove any active DS records listed there.

Step 2: Disable DNSSEC on Your Old DNS Provider (If Applicable)

If you previously managed DNS through Cloudflare or another third-party provider, log into the old account, go to the DNS tab, scroll down to DNSSEC, and ensure it is turned off.

Step 3: Wait for Registry Cache Invalidation

Unlike standard DNS records, DS records at the TLD level usually have a TTL (Time to Live) ranging between 1 to 24 hours. Once the parent zone removes the DS record, recursive resolvers will immediately begin serving your website again without verification errors.

Step 4: Re-enable DNSSEC Correctly (Optional)

If you want to keep the security benefits of DNSSEC with your new hosting provider:

  1. Wait until your website is fully accessible globally.
  2. Enable DNSSEC inside your new host or DNS provider dashboard.
  3. Copy the newly generated DS record details (Key Tag, Algorithm, Digest Type, Digest).
  4. Paste these new values into your domain registrar's DNSSEC management panel.

Summary

Never change nameservers on a domain with active DNSSEC without first disabling it or transferring the keys. If your domain goes dark right after a migration, delete the DS record at your registrar to get your website back online immediately.