What Is DNSSEC and How to Enable It
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records. Validating resolvers can detect forged answers — for example a fake A/AAAA record that points visitors at a phishing host. It does not encrypt DNS queries by itself (that is DoH/DoT), and it does not replace HTTPS.
Key takeaways
- Enable DNSSEC where your DNS is hosted, then publish DS records at the registrar if they are separate.
- Broken DNSSEC (signed but invalid chain) can make the domain fail to resolve for validating resolvers — test carefully.
- Our report shows whether DNSSEC validates for the checked domain (informational).
- Pair with CAA for certificate issuance control.
How to enable it (typical flow)
- At your DNS host (Cloudflare, Route 53, registrar DNS, etc.): turn on DNSSEC / DNSSEC signing for the zone. Many hosts generate keys and signatures for you.
- At the domain registrar: if nameservers are not the registrar’s own, copy the DS record (digest) the DNS host shows into the registrar’s DNSSEC / DS panel. Without DS at the parent, the chain of trust is incomplete.
- Wait for propagation, then check with a validating resolver or our HTTPS checker DNSSEC section.
Cloudflare (short path)
If the domain uses Cloudflare nameservers: DNS → Settings → enable DNSSEC, then add the displayed DS record at the registrar (Cloudflare documents the exact fields). Full-setup zones on Cloudflare often walk you through this in the dashboard.
Common pitfalls
- Enabling signing but never publishing DS at the parent.
- Changing nameservers without removing or updating old DS records.
- Manual key rollovers without updating DS — can cause SERVFAIL for validating clients.