What is DNSSEC?

When someone opens your site, their device asks a DNS server for the domain’s IP address. Normally it has no way to tell whether the answer really came from your DNS provider or was changed on the way. DNSSEC adds a digital signature to every answer, so DNS resolvers that validate signatures can spot a tampered answer and reject it.

Why it matters

Without DNSSEC, an attacker who can slip in a forged DNS answer can send your visitors to their own server or redirect your domain’s email. With DNSSEC such an answer carries no valid signature, and validating resolvers throw it away.

The two halves

Turning DNSSEC on takes two parts: your DNS provider (where you edit records) signs the records, and your registrar (where you bought the domain) publishes a DS record in the parent zone that points to your signing key. When the DNS provider and the registrar are the same company, it is usually one switch; some providers also send the DS record to the registrar automatically.

1. In your DNS provider’s panel, find the DNSSEC setting and turn it on. The provider signs your records and shows the DS record to publish.
2. Note the DS values: key tag, algorithm, digest type and the digest itself. See the example below.
3. In your registrar’s panel, open the DNSSEC or DS record section and enter exactly those values. If your DNS provider says this happens automatically, skip this step.
4. Wait a few hours; the DS record can take a while to appear in the parent zone.
5. Check the domain again on CheckNet’s DNS page; you should see “DNSSEC is on”.

example.com.  3600  IN  DS  2371 13 2 1F987CC6583E92DF0890718C42...

The risk of a broken chain

If the DS record stays at the registrar but your records are no longer signed with the matching key, validating resolvers treat the whole domain as bogus: your site and email stop working for many users. This happens most often when moving to another DNS provider.

• Moving DNS providers: first remove the DS record at the registrar, wait a day or two for cached answers to expire, then change the name servers and turn DNSSEC on again at the new provider.
• Turning DNSSEC off: again remove the DS record first, and switch off signing only after enough time has passed; the reverse order takes the domain down.
• A typo in the DS value: one wrong character breaks the chain. Copy the value straight from your DNS provider’s panel.

Not every top-level domain supports DNSSEC, and not every registrar lets you add a DS record. If your registrar’s panel has no such section, ask their support.

Check it with CheckNet

On CheckNet’s DNS page, “DNSSEC is on” means the parent zone has a DS record and the resolver that ran the lookup validated the answer. If you see “DNSSEC is off”, one of the two halves is missing or has not spread everywhere yet.