IBM Cloud Internet Services ALIAS records with DNSSEC: certificate validation behavior

Direct answer

No. IBM Cloud Internet Services (CIS) does not document an automatic DNSSEC adjustment for a zone simply because it contains ALIAS records that point to external domains. ALIAS flattening and DNSSEC signing are separate DNS functions, and Certificate Manager evaluates TLS material independently of the ALIAS target's DNSSEC status.

Likely explanation and confirmed boundary

Likely explanation

When CIS resolves an ALIAS record, it flattens the external target into address records at the CIS edge. The external target's zone and DNSSEC chain remain outside your CIS zone, so CIS cannot repair, bypass, or disable validation for that external chain. A validating resolver may still return SERVFAIL if the external zone is misconfigured or unsigned, but that is a DNS-layer failure, not a certificate-layer failure.

Confirmed boundary

Certificate Manager validation is judged on the TLS material presented for the exact client-facing hostname. That includes SAN coverage, a complete chain to a trusted root, validity period, and revocation status. ALIAS flattening can hide the final CNAME target from clients, so hostname checks must use the original hostname, not the target hostname.

Steps for this case

1. Resolve the CIS hostname and the external ALIAS target with DNSSEC validation enabled from multiple vantage points. Compare answers, validation status, and any SERVFAIL.
2. Inspect the TLS certificate served for the exact client-facing hostname. Verify SAN coverage, expiration, full chain, and revocation against the same endpoint Certificate Manager uses.
3. Confirm the CIS zone DNSSEC status and the current ALIAS target. Repeat after any target change and capture exact error text to separate DNS resolution from certificate validation.

Regional variation and expectations

Regional or POP-specific DNS behavior is an operational detail and should not change the validation rule. Set expectations per hostname and per TLS endpoint. For external targets, assume DNSSEC is validated only where the external zone is signed and the client resolver validates DNSSEC; otherwise DNSSEC has no effect on Certificate Manager outcomes.

One diagnostic detail that changes the recommendation

If behavior differs across regions, provide the precise validation error text and whether it occurs during DNS resolution or during TLS/certificate checks. That distinction determines whether the issue is a DNSSEC chain problem or a Certificate Manager hostname/chain/revocation problem.

Note: DNSSEC and ALIAS interactions are implementation-sensitive. Verify current IBM CIS behavior in your specific regions before relying on this guidance.