dnssec

What is checked: the zone holding your website's domain is signed, its DS record is published at the parent (.ch, .swiss, ...), and answers validate (RFC 4033).

Why it matters: DNSSEC stops attackers from forging DNS answers that send your residents to a fake site or divert your mail.

Smallest fix: ask your DNS operator to enable DNSSEC signing, then ask your registrar to publish the DS record they give you. Most Swiss DNS hosts and registrars do both in a few clicks, and many do it automatically (CDS/CDNSKEY).

If the census says "signed but broken": fix this first. Validating resolvers (used by many ISPs and public resolvers) currently can't reach your domain at all. The usual cause is a DS record left at the registrar after moving DNS to a new host. Either re-sign at the new host and update the DS, or remove the DS.