Security
How to Enable DNSSEC for Your Domain
DNSSEC cryptographically signs your DNS records so resolvers can verify they haven't been tampered with. Without DNSSEC, attackers controlling the network path can serve fake DNS responses — the basis for many phishing and BGP hijacking attacks.
Try our SSL checker1. Enable DNSSEC at your DNS provider
Cloudflare Route53 Google Cloud DNS and most modern providers have a one-click DNSSEC toggle. They generate a Key Signing Key (KSK) and produce a DS (Delegation Signer) record.
2. Add the DS record at your registrar
Copy the DS record from your DNS provider paste it into your domain registrar's DNS/DNSSEC section. This anchors trust from the parent zone (your TLD) to your zone.
3. Wait for propagation
DS record propagation usually completes in a few hours. During this window DNSSEC validation is intermittent — some resolvers see signed records others don't. Both states are safe.
4. Verify
Run our SSL checker or use dig +dnssec yourdomain.com — look for the 'AD' (Authenticated Data) flag in responses. Modern algorithms to use: ECDSAP256SHA256 or ED25519. Avoid RSASHA1 — deprecated.
Want to verify your setup?
Run the check now