Most DNS-import problems trace to one of four causes: DNS hasn't finished spreading, DNSSEC isn't set up correctly, you have two TXT records by accident, or your TLD has a custom integration. Match your symptom in the table below, then run the fix.
Find your symptom
What you're seeing | What it means | Go to |
The ENS App keeps saying my DNS records aren't there, but they look right | DNS changes still spreading — or a typo in the record | Records not picked up |
I turned on DNSSEC at my registrar, but the ENS App says it's not enabled | DNSSEC chain is broken somewhere — check with the Analyzer | DNSSEC not detected |
I switched from offchain to onchain and now the import fails | Two TXT records present — ENS sees both | Two TXT records |
The ENS App shows a "custom setup" message about my TLD | TLD operator runs its own ENS integration | Custom TLD |
If you're not sure which case you're in, paste your domain into ens-resolution.vercel.app — what it shows points you to one of the sections.
Good to know
DNS changes can take 10–30 minutes to spread. If your records are correct, wait and refresh.
Your domain needs DNSSEC with RSA/SHA-256 or ECDSA keys. WordPress.com doesn't support DNSSEC — move your DNS to another provider if you're hosted there.
The cluster's other articles cover the choice between routes (Can I use my DNS domain as an ENS name?), the onchain steps (How do I import my DNS domain into ENS?), and the offchain steps (How do I import my DNS domain into ENS without paying gas?).
Important: DNS controls ENS. ENS ownership of a DNS name follows DNS ownership. If your DNS domain expires or transfers, your ENS name goes with it. Keep your DNS domain active to keep control.
Records not picked up
DNS changes don't reach every DNS server at the same time. After you save a record at your registrar, the ENS App might still be reading an older view.
Wait 10–30 minutes and refresh the page. If you've waited longer:
Check the record values at your DNS host. Type, Name, and Value all have to be exact:
Onchain:
Type: TXT·Name: _ens·Value: a=0xYourWalletAddressOffchain:
Type: TXT·Name: @(root) ·Value: ENS1 dnsname.ens.eth 0xYourWalletAddress
For offchain, verify the lookup at ens-resolution.vercel.app.
If the record is correct and 30+ minutes have passed, the issue is probably DNSSEC — see the next section.
DNSSEC not detected
DNSSEC has several moving parts: keys at your registrar, a DS record at the parent zone, signatures across the DNS chain. A break anywhere in that chain makes DNSSEC look enabled at your registrar but fail when ENS verifies it.
Run the DNSSEC Analyzer (verisignlabs.com) against your domain. It walks the chain and reports the specific failure. Common causes:
Missing DS record at the parent zone (your registrar usually sets this, but not always automatically).
Wrong key algorithm — only RSA/SHA-256 and ECDSA work with ENS.
WordPress.com doesn't support DNSSEC. Move your DNS to another provider while keeping WordPress for the site.
Some hosts charge extra for DNSSEC; confirm it's actually active.
Fix what the Analyzer flags, wait 10–30 minutes for the change to spread, then re-check in the ENS App.
Two TXT records
You can switch from offchain to onchain, but not the other way around. Once a name is imported onchain, reverting to offchain isn't supported.
If you set up the offchain route and then tried to import onchain without deleting the offchain TXT record, ENS sees both records and the import fails.
Recovery (offchain → onchain):
Delete the offchain
ENS1 …record atName: @at your DNS host.Wait 10–30 minutes for the change to spread.
Add the onchain record:
Type: TXT·Name: _ens·Value: a=0xYourWalletAddress.Follow How do I import my DNS domain into ENS? from Step 3 to claim the name and approve the transaction.
Custom TLD
Some TLDs — .box is the most common example — run their own ENS integration outside the standard DNS-import flow. If the ENS App shows a message like "The team behind [].tld have customised their ENS experience", your TLD is in this group.
What this means:
You can't import the name through the ENS App's standard flow.
The TLD operator controls how their names work with ENS — different process, different tools, different docs.
ENS support can't help with the specifics.
Contact the team behind your TLD. They run the integration and have the docs and the support channel.
What's next?
How do I import my DNS domain into ENS? — onchain steps
How do I import my DNS domain into ENS without paying gas? — offchain steps
Can I use my DNS domain as an ENS name? — onchain vs offchain
DNSSEC Analyzer — verify your DNSSEC setup