What is DNSSEC and how do you enable it?

DNSSEC puts a digital signature on your domain's DNS records. This lets resolvers verify that an answer really comes from your name servers and wasn't forged along the way. Adoption varies by country; the Netherlands is among the leaders, with .nl among the extensions with the most signed domains.

Check your website now

What DNSSEC protects against

Without DNSSEC, a resolver can't verify whether a DNS answer is correct. An attacker can then get a forged answer cached (DNS spoofing or cache poisoning), sending visitors to a different server or email somewhere else, even though they typed your domain name correctly.

With DNSSEC, your name servers sign every answer. Resolvers that validate DNSSEC, such as those of many internet providers, reject an answer whose signature doesn't match.

How it works

The signatures form a chain. Your DNS provider signs your records with a key, and a DS record at the registry of the domain extension (such as Verisign for .com or SIDN for .nl) points to that key. The registry in turn is signed from the root of DNS. This lets a resolver verify the chain from top to bottom.

Enabling DNSSEC

You usually enable DNSSEC at your registrar or DNS provider, often with a single setting. They then sign your records and pass the DS record on to the registry. If your DNS and your domain registration are with different companies, you sometimes have to enter the DS record at your registrar yourself.

Some hosting providers already enable DNSSEC by default; in the Netherlands, for example, many do so for .nl domains.

Watch out when migrating

If you move your DNS to another provider while the old DS record is still at the registry, the signatures no longer match the new name servers. Resolvers that validate DNSSEC can then no longer look up your domain: website and email stop working for a large share of visitors.

So turn DNSSEC off before a migration and wait until the DS record is gone, or have the old and new provider handle the transfer together. Then turn DNSSEC back on at the new provider.

DNSSEC doesn't encrypt anything: anyone can still read your DNS records. It only proves they're genuine.

Check DNSSEC yourself

With dig you can see whether a domain has a DS record and whether a validating resolver considers the answer genuine. If ad (authenticated data) appears among the flags, the signature checks out.

Terminal

dig +short example.com DS
dig +dnssec example.com A @1.1.1.1

How SteadyHost rates DNSSEC

OK: DNSSEC is on and the signatures are valid.
Warning: DNSSEC isn't on.
Problem: DNSSEC is on, but the signatures aren't valid. Resolvers that validate DNSSEC then can't look up the domain.
This check doesn't count toward the score.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.