DNSSEC: What It Is and How to Enable It

What is DNSSEC?

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, preventing attackers from forging DNS responses.

Without DNSSEC:

You → DNS resolver → Attacker's fake response → Phishing site

With DNSSEC:

You → DNS resolver → Verifies signature → Rejects fake response

How It Works

1. The domain owner signs DNS records with a private key
2. The public key is published as a DS record at the parent zone
3. Resolvers verify the chain of trust from root → TLD → your domain

Key Record Types

Enabling DNSSEC

At Your Registrar

Most registrars support DNSSEC activation:

1. Generate DNSSEC keys (often automatic)
2. Add DS record to parent zone (registrar does this)
3. Sign your zone

With Cloudflare

If using Cloudflare DNS:

1. Go to DNS → Settings
2. Click Enable DNSSEC
3. Copy the DS record details
4. Add the DS record at your registrar

Verification

# Check if DNSSEC is active
dig +dnssec example.com

# Look for 'ad' flag (Authenticated Data)
dig +dnssec +multi example.com SOA

# Verify full chain
delv @8.8.8.8 example.com A +rtrace

Common Issues

Warning If you change DNS providers, you must update DNSSEC records at both the old and new provider. Mismatched DNSSEC records will cause your domain to become unresolvable.

Tip If your domain is behind Cloudflare (proxy mode), Cloudflare handles DNSSEC automatically. You only need to add the DS record at your registrar once.