safety.google
⚠ Signed, not validating
DNSKEY records exist, but the resolver did not set the Authenticated Data flag — usually a missing or mismatched DS at the registrar, so the chain of trust is broken.
- DNSKEY
- 2 key(s)
- Algorithm
- 8 · RSASHA256
- DS in parent
- none
- AD flag
- not set
Checked 26 Oct 2026 by our weekly check.
What this means for safety.google
safety.google publishes DNSKEY records, so the zone is signed, but resolvers do not treat it as secure. Usually the DS record is missing at the registrar, or it points at a key the zone no longer uses. See how to enable DNSSEC (step 3) and troubleshooting.
More: Google (.google)
Full list: Brand extension sites →