# Query Log shows Status: OK (cache) INSECURE

**URL:** <https://discourse.pi-hole.net/t/query-log-shows-status-ok-cache-insecure/62835>\
**Category:** Community Help\
**Created:** [May 7, 2023, 8:19pm UTC](https://discourse.pi-hole.net/t/query-log-shows-status-ok-cache-insecure/62835 "2023-05-07T20:19:20Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [May 7, 2023, 8:57pm UTC](https://discourse.pi-hole.net/t/query-log-shows-status-ok-cache-insecure/62835/2 "2023-05-07T20:57:13Z")

</div>

> [@titust11](#):
>
> Am I doing something wrong?

No.  
INSECURE just means that the authoritative DNS server for a given domain does not offer digitally signed DNS records, so DNSSEC validation cannot be performed at all.

It's only when such a DNS server supports DNSSEC that Pi-hole could distinguish between autthentic SECURE DNS records and compromised BOGUS ones.

Without DNSSEC validation, Pi-hole cannot establish whether the integrity of DNS records has been compromised or not. Consequently, the DNS records are exactly as reliable as with plain DNS.

See also [Understanding DNSSEC validation using Pi-hole's Query Log](https://discourse.pi-hole.net/t/understanding-dnssec-validation-using-pi-holes-query-log/51574).

---

_[View the full topic](https://discourse.pi-hole.net/t/query-log-shows-status-ok-cache-insecure/62835)._