- Short answer
- Shopify-managed domains don't support DNSSEC; on a third-party domain, a broken DNSSEC setup keeps the domain from fully connecting.
- Shopify-managed signal
- An admin notification says the DNSSEC record is unsupported and to contact Support to remove it.
- Broken third-party DNSSEC
- Domain isn't considered fully connected, even when all other DNS records are correct.
- After turning it off
- If the DNSSEC error continues, DNSSEC records can stay published; your provider can check.
- SSL symptom
- Activated DNSSEC is one listed cause of an SSL unavailable message.
Which domains can keep DNSSEC on Shopify?
It depends on who manages the domain, per Shopify's help center:
- Shopify doesn't support DNSSEC here.
- DNSSEC transferred in with the domain stops it resolving.
- Shopify Support removes the record.
- A broken setup can block resolving or cause SSL certificate issues.
- While broken, the domain isn't fully connected, even with correct records.
- Fix: turn DNSSEC off (standard), or your provider corrects the setup.
No Shopify domain help page or changelog we read on October 23, 2026 explains enabling DNSSEC on a Shopify-managed domain, or why it's unsupported.
How does Shopify tell you DNSSEC is the problem?
On a Shopify-managed domain, the notification reads:
Your domain has an unsupported DNSSEC record. Shopify doesn't support DNSSEC at this time. Contact support to have it removed.
A third-party domain with broken DNSSEC gets "A DNSSEC misconfiguration is blocking access to your DNS records," plus a Disable DNSSEC step and a warning banner in the connection flow.
Separately, Shopify's SSL unavailable troubleshooting names activated DNSSEC as a common cause, and both its steps and the TLS or SSL pending steps say to deactivate it (see SSL pending past 48 hours).
On a third-party domain, should you turn DNSSEC off or fix it?
Turning it off is Shopify's standard fix. In your provider's dashboard, the setting might be under DNS, Advanced DNS, Domain Security or Domain Settings; otherwise, ask the provider to deactivate DNSSEC. If Cloudflare hosts your DNS, contact Cloudflare and your registrar before you change it: settings can be split between them, and turning DNSSEC off in the wrong order can make your store and email unreachable.
Allow up to 48 hours for the change to propagate, then check Settings > Domains: the DNSSEC warning should disappear and the domain should connect once all other DNS records are correct. If the DNSSEC error continues, contact your provider to check for DNSSEC records still published.
To keep DNSSEC, have your provider correct the setup instead — and confirm the fix with them: Shopify's passing check doesn't prove DNSSEC works correctly.
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy