Docs

Turn on DNSSEC

Turn on DNSSEC

Every visit to your site and every message to your mailboxes starts with a DNS lookup. Plain DNS answers are not signed, so a resolver that is tricked or a network that is tampered with can hand out a different IP address for example.com, and the visitor ends up somewhere else without seeing anything wrong. DNSSEC signs your DNS answers, and resolvers that check signatures (most large public ones do) reject an answer that has been changed.

The site checklist shows an unsigned domain as information, not as a problem: most domains are still unsigned. With the right DNS provider it is a few minutes of work.

Two places, two steps

DNSSEC needs two things, and they are often in two different places:

Step Where What happens
1. Sign the zone where your DNS is hosted (the nameservers) the DNS host creates keys and signs every answer
2. Publish the DS record at the registrar (where you pay for the domain) the registry for .com, .si, .pl … learns which key to trust

If the DNS host and the registrar are the same company, both steps are usually one switch. If they are different (DNS on Cloudflare, domain at a registrar), you copy the DS record from the first to the second.

Warning: the two halves must always match. A DS record at the registrar without signed DNS, or with keys from a previous DNS provider, makes the domain unreachable for everyone whose resolver checks signatures: website, mail, everything. Read the section on changing DNS providers below before you ever move the domain.

Check it yourself

dig +short DS example.com
dig @1.1.1.1 +dnssec example.com A

The first command prints the DS record (published at the registry) or nothing. In the output of the second, the flags: line contains ad when a validating resolver verified the signatures. Fixed means a DS line from the first command and ad in the second.

For a full picture, enter the domain at dnsviz.net: it draws the chain from the root to your domain and marks any broken link in red.

How to fix

Start where the DNS is hosted (dig +short NS example.com tells you), then finish at the registrar.

Cloudflare

  1. Open the domain and go to DNS → Settings.
  2. Under DNSSEC click Enable DNSSEC.
  3. Cloudflare shows the DS record: key tag, algorithm 13, digest type 2 and the digest. Keep this page open.
  4. Log in at your registrar and add the DS record there with exactly these values (see the DNS provider tab). Some registrars ask for the DNSKEY (public key, flags 257) instead; Cloudflare shows that too.
  5. Back in Cloudflare the status changes from Pending to Success once the registry publishes the record, usually within a few hours, sometimes up to a day or two.

If the domain is registered with Cloudflare Registrar, step 4 happens automatically.

DNS provider

If your registrar also hosts your DNS (the nameservers are the registrar's own): look in the domain's settings for DNSSEC and turn it on. Most registrars sign the zone and publish the DS record in one step.

If your DNS is hosted elsewhere (Cloudflare, your web host): first enable DNSSEC there, then add the DS record at the registrar. In the domain's settings, find DNSSEC or DS records and enter the values your DNS host shows:

Field Example
Key tag 2371
Algorithm 13 (ECDSA P-256 SHA-256)
Digest type 2 (SHA-256)
Digest 1F987CC6583E92DF0890718C42… (copy it exactly)

Most registrars support DNSSEC for common endings like .com, .eu, .si and .pl. If yours offers no DNSSEC option, ask support; if they cannot add a DS record, the only way is to move the domain to a registrar that can.

cPanel

Whether cPanel can sign your zone depends on the host: it works when the server runs PowerDNS and the host has enabled it.

  1. Open Domains → Zone Editor.
  2. If there is a DNSSEC link next to the domain, open it and Create Key (keep the suggested algorithm, ECDSA P-256 if offered).
  3. cPanel shows the DS record. Add it at your registrar (see the DNS provider tab).

If there is no DNSSEC option, your host does not sign zones on this server. Ask them, or host DNS somewhere that supports it (Cloudflare's free plan does).

If the domain's nameservers are not the host's (for example Cloudflare), DNSSEC must be turned on there, not in cPanel.

Plesk

Plesk signs zones through its free DNSSEC extension, which the server administrator installs from Extensions.

  1. With the extension installed, open Websites & Domains → example.com → DNSSEC.
  2. Turn on signing for the domain, keep the suggested algorithm and click OK.
  3. Plesk shows the DS record. Add it at your registrar (see the DNS provider tab).

If you see no DNSSEC option, ask the host. If the domain uses external DNS, turn on DNSSEC there instead.

Changing DNS provider with DNSSEC on

This is how domains go dark. The old provider's keys are in the DS record at the registry; the new provider signs with different keys (or not at all), and validating resolvers reject every answer.

The safe order:

  1. At the registrar, remove the DS record.
  2. Wait until the old DS record has expired from caches: at least its TTL, in practice one to two days.
  3. Change the nameservers to the new provider.
  4. Once the new provider answers, enable DNSSEC there and add its new DS record at the registrar.

Some providers support a transfer with both keys published at once, which avoids the gap; if yours does not offer it explicitly, use the order above.

Confirm the fix

Run the dig commands from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab. The item shows the domain as signed within a few minutes once the registry publishes the DS record.