A completed registrar transfer does not by itself prove every DNS lookup is healthy. If some visitors see failures, DNSSEC validation is one possible cause. Treat SERVFAIL as a diagnostic clue and collect evidence before changing security settings or delegating the domain again.
Separate delegation from the validation chain
Nameservers identify the DNS service, while DNSSEC lets validating resolvers check the expected chain of trust. Keep the active DNS provider and recent key changes documented separately. A registrar-only transfer is a different operation from replacing the DNS service or changing its keys.
Record exactly where SERVFAIL appears
Record the queried name, record type, time and status, then compare another resolver and a DNSSEC analysis. A stale DS relationship can cause validation failure, but SERVFAIL also has other DNS causes. A single successful browser visit does not establish the root cause.
Have DS and DNSKEY checked together
Ask the registrar and DNS provider to assess the parent-zone DS relationship and the active zone’s DNSKEY data together. Provide the analysis and public check values. Adding a DS value as a TXT record does not repair the parent delegation; private signing keys should not be included in a support ticket.
Prepare a complete nameserver change →
Coordinate the repair with the operators
Agree the required change, the responsible operator and the verification step. At nlnamen.nl a DNSSEC key change requires coordinated administration rather than simply submitting the standard nameserver form. Record when the next check will happen so that two operators do not make conflicting repairs.
Confirm recovery for both website and email
Repeat the same DNS checks after the repair, compare them with the earlier notes and test HTTPS plus incoming and outgoing mail. Keep the cause and resolution in the domain documentation. Give later registrar, DNS or key changes their own plan and verification steps.
Your practical checklist
- Record changes made alongside the transfer.
- Keep resolver status, record type and time.
- Have delegation and DS/DNSKEY assessed together.
- Coordinate one repair with the operators.
- Retest the website and email afterwards.
A business moves both registration and DNS. The new zone contains the intended web and mail records, but analysis indicates an old DS relationship. Its support request includes the change time, nameservers and analysis, letting the operators agree the repair and repeat the same checks.
Common questions
Does SERVFAIL always mean DNSSEC is broken?
No. DNSSEC validation is one possible cause, but nameserver availability and other DNS problems can also produce it. Assess the actual responses and analysis.
Must DNSSEC be disabled for a .nl transfer?
Not as a default step. Preserving the chain requires a suitable transfer procedure and coordination. Agree any necessary DNS or key change in advance.
Sources and further reading
- Google Public DNS: domain troubleshooting
- Cloudflare: troubleshoot DNSSEC
- SIDN: DNSSEC en veilige verhuizing
Registration rules and provider functions can change. Check the current requirements for your domain before ordering or changing services.
Ready for your own .nl?
€9.99 for year one, €12.99 renewal or 3 years for €27. No hosting required.
Check your domain →
