Found DNSKEY, but no RRSIG, for algorithm 8

Website, Application, Performance DNS & Network
1

What is the name of the domain?

hyperlane.xyz

What is the error message?

Found DNSKEY, but no RRSIG, for algorithm 8

What is the issue you’re encountering

The error “Found DNSKEY, but no RRSIG, for algorithm 8” on dnssec-debugger

What steps have you taken to resolve the issue?

Disabled DNSSEC for a few hours to no avail.
Users have reported that the domain (Hyperlane.xyz) does not load up when trying to connect to it through Wi-Fi in multiple regions.

What feature, service or problem is this related to?

DNSSEC

2

I believe Cloudflare only supports Algo-13.

So curious where the additional key is coming from:

$ dig DNSKEY hyperlane.xyz +short @1.1.1.1
256 3 8 AwEAAdJqB0BIa9ONhfMacADbbRpoPc3Mo1wd2uHMprgqz1bjnxyXu2ng
256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8 KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+ KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
1 Like
3

@GeorgeAppiah I also disabled DNSSEC for a couple of hours and then re-enabled it to no avail, in the hopes that the additional key would be wiped out, but it’s still there.
Any solutions come to your mind?

4

You need to open a registrar ticket to have that algo removed.

2 Likes
5

@cscharff Thank you very much for your attention. This domain was initially registered with Google Domains, then automatically transferred to Squarespace, and then I moved it to Cloudflare.
I cannot open tickets with Squarespace as they say this is not on their plate anymore.
Should I attempt to remove the key manually?

6

You should open a ticket with Cloudflare Registrar as that who is the current registrar for your domain.

2 Likes
7

@cscharff Understood! Will do today and update you, thank you very much.
Just out of curiosity, you don’t think something like DNSKEY record found but no DS record found - #6 by user15716 will solve my problem, no?

1 Like
8

You can certinly try it. It won’t hurt anything… Cloudflare’s registrar support and integration is nominal.

1 Like
9

@cscharff Manually deleting DNSSEC records worked!
I first disabled DNSSEC on the dashboard, then manually deleted the records immediately, and then re-enabled DNSSEC and it’s clean now. Thanks!

1 Like
10

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.