How to turn on DNSSEC
DNSSEC signs your DNS answers so nobody can forge where your website or mail points. Usually one switch at your DNS host plus a DS record at the registrar.
Step by step, with screenshots: What is DNS? Records, resolvers and TTLs in plain language →
Check your own domain
Our DMARC checker (email & DNS) tool runs this check and writes the record to add, free, in seconds.
What it is
DNSSEC (Domain Name System Security Extensions) adds digital signatures to your domain's DNS records, so resolvers can check that an answer really comes from your DNS host and was not forged. Without it, an attacker who poisons a resolver's cache can send visitors or email for your domain to a server they control.
Turning it on takes two steps: your DNS host signs the zone, and your registrar publishes a DS record that links the signature to the parent zone, such as .com. Many hosts and registrars do both with one switch. getReport asks a validating resolver about your domain and warns when the answer is not authenticated. Your domain is OK when DNSSEC validates; take care when moving DNS hosts, as a stale DS record makes the domain unreachable.
What a passing site looks like
- DNSSEC protects the domain's DNS answerswarning · −3 ptseffort M
DNSSEC is not enabled for the domain
Why it matters. DNSSEC signs your DNS records so resolvers can reject forged answers, the attack behind hijacked websites and intercepted mail. Most registrars turn it on with one switch.
- Turn on DNSSEC at your DNS host (Cloudflare, most registrars and hosts have a switch) and, if the registrar is separate, add the DS record it gives you there.
Questions people ask
How do I test if DNSSEC is enabled for my domain?
Run a getReport check, which asks a validating resolver whether your domain's answers are authenticated. For more detail, Verisign's DNSSEC Analyzer and DNSViz show the chain of trust from the root to your domain and point to any broken link. From a terminal, dig +dnssec example.com shows the ad flag when the answer was validated.
How do I enable DNSSEC on Cloudflare?
In the Cloudflare dashboard, open the DNS settings for your domain and enable DNSSEC. Cloudflare then shows the DS record details: key tag, algorithm, digest type and digest. Add them at your domain registrar; some registrars, including Cloudflare Registrar, do this automatically. It can take up to a day for the parent zone to publish the DS record and validation to start.
How does DNSSEC work?
Your DNS host signs each set of records with a private key and publishes the signatures and public keys as extra records. The parent zone, such as .com, holds a DS record with a fingerprint of your key, and the root signs .com, forming a chain of trust. A validating resolver checks every link and rejects answers that do not match.
What is the difference between DNS and DNSSEC?
DNS translates names into addresses but has no way to prove an answer is genuine. DNSSEC is an extension that adds signatures to those answers, so resolvers can detect forgery. It does not encrypt DNS queries or hide which sites someone looks up; that is what DNS over HTTPS and DNS over TLS do.