diff --git a/management/status_checks.py b/management/status_checks.py index 68755cb7..a6db4a16 100755 --- a/management/status_checks.py +++ b/management/status_checks.py @@ -666,7 +666,7 @@ def check_dnssec(domain, env, output, dns_zonefiles, is_checking_primary=False): return output.print_error("""This domain's DNSSEC DS record is incorrect. The chain of trust is broken between the public DNS system and this machine's DNS server. It may take several hours for public DNS to update after a change. If you did not recently - make a change, you must resolve this immediately (see below).""") + make a change or are using external DNS, you must resolve this immediately (see below).""") output.print_line("""Follow the instructions provided by your domain name registrar to set a DS record. Registrars support different sorts of DS records. Use the first option that works:""") @@ -695,6 +695,7 @@ def check_dnssec(domain, env, output, dns_zonefiles, is_checking_primary=False): output.print_line(ds_suggestion['record'], monospace=True) if len(ds) > 0: output.print_line("") + output.print_line("If you are using external DNS you may ignore this") output.print_line("The DS record is currently set to:") for rr in sorted(ds): output.print_line("Key Tag: {}, Algorithm: {}, Digest Type: {}, Digest: {}".format(*rr))