Most DNS-import problems trace to one of four things: DNS hasn't finished spreading, DNSSEC isn't set up correctly, you're looking at the offchain result when you wanted the onchain one, or your TLD has a custom integration. Match your symptom below, then run the fix.
Find your symptom
What the app says | What it means | Go to |
The app can't find your TXT record, but it looks right at your DNS host | DNS changes still spreading — or a typo in the record | Records not picked up |
"DNSSEC is not enabled" | DNSSEC isn't on, or the chain is broken somewhere — the Analyzer tells you which | DNSSEC not detected |
The app shows your offchain setup when you expected the onchain one | The offchain record is resolving, which keeps the claim window shut | Both TXT records set |
"The team behind | TLD operator runs its own ENS integration | Custom TLD |
If you're not sure which case you're in, paste your domain into ens-resolution.vercel.app — what it shows points you to one of the sections.
Good to know
DNS import needs a real DNS domain — one whose TLD comes from the ICANN root, like
.com,.org,.xyz, or a country code such as.uk. A TLD that isn't part of DNS can't be imported at all.DNS changes can take 10–30 minutes to spread. If your records are correct, wait and refresh.
Your domain needs DNSSEC with RSA/SHA-256 or ECDSA keys. WordPress.com doesn't support DNSSEC — move your DNS to another provider if you're hosted there.
Not sure which route you took? See Can I use my DNS domain as an ENS name?
Important: DNS controls ENS. Whoever owns the DNS domain can reclaim the ENS version at any time by changing the TXT record at their DNS provider. If your domain expires or you transfer it, the new owner can take the ENS name. Keep your DNS domain active to keep control.
Records not picked up
DNS changes don't reach every DNS server at the same time. After you save a record at your registrar, the ENS App might still be reading an older view.
Wait 10–30 minutes and refresh the page. If you've waited longer:
Check the record values at your DNS host. Type, Name, and Value all have to be exact:
Onchain:
Type: TXT·Name: _ens·Value: a=0xYourWalletAddressOffchain:
Type: TXT·Name: @(root) ·Value: ENS1 dnsname.ens.eth 0xYourWalletAddress
For offchain, verify the lookup at ens-resolution.vercel.app.
If the record is correct and 30+ minutes have passed, the issue is probably DNSSEC — see the next section.
DNSSEC not detected
On the Enable DNSSEC step the app shows "DNSSEC is not enabled". It says the same on both routes, offchain and onchain.
That one line is all the app can tell you. It doesn't say why, so the next check happens in the DNSSEC Analyzer below.
DNSSEC has several moving parts: keys at your registrar, a DS record at the parent zone, signatures across the DNS chain. A break anywhere in that chain makes DNSSEC look enabled at your registrar but fail when ENS verifies it.
Run the DNSSEC Analyzer (verisignlabs.com) against your domain. It walks the chain and reports the specific failure. Common causes:
Missing DS record at the parent zone (your registrar usually sets this, but not always automatically).
Wrong key algorithm — only RSA/SHA-256 and ECDSA work with ENS.
WordPress.com doesn't support DNSSEC. Move your DNS to another provider while keeping WordPress for the site.
Some hosts charge extra for DNSSEC; confirm it's actually active.
Fix what the Analyzer flags, wait 10–30 minutes for the change to spread, then press the refresh button beside the message in the app. It shows when it last checked.
Both TXT records set
Having both records set is not an error. They belong to two different routes, and the offchain one takes over until you remove it.
Route | The record | What happens |
Offchain |
| Resolves in the app on its own. No import, no transaction. |
Onchain |
| Needs the import step first. It resolves once the import is done. |
While the offchain record exists, the app just resolves the name. The claim window never opens, so there is no way to pick the onchain route — that is what makes it look stuck.
To move to onchain:
Delete the offchain
ENS1 …record atName: @at your DNS host.Add the onchain record if it isn't there yet:
Type: TXT·Name: _ens·Value: a=0xYourWalletAddress.Wait 10–30 minutes for the change to spread.
Open the name in the ENS App again. The claim window appears and asks how you'd like to import your domain.
Choose Onchain, then follow Onchain DNS import to claim the name and approve the transaction.
You can move from offchain to onchain, but not the other way around. Once a name is imported onchain, you can't revert it to offchain.
Custom TLD
The app says: "The team behind [].tld have customised their ENS experience", with your own TLD in place of [].tld.
Some TLDs — .box is the most common example — run their own ENS integration outside the standard DNS-import flow. If you see that message, your TLD is in this group. What this means:
You can't import the name through the ENS App's standard flow.
The TLD operator controls how their names work with ENS — different process, different tools, different docs.
ENS support can't help with the specifics.
Contact the team behind your TLD. They run the integration and have the docs and the support channel.