What DNS is
When someone visits your website or emails you, their computer first asks DNS where your domain’s website and mail servers are. Without DNSSEC, a well-placed attacker can, in some situations, send back a false answer and redirect that traffic.
What DNSSEC adds
Your DNS provider signs your records, and the signature is linked up through the domain’s registry. A resolver that checks DNSSEC can then reject answers that weren’t signed by your domain. It doesn’t encrypt anything; it proves the answers are genuine.
Turning it on safely
- It needs your DNS provider and your registrar to cooperate. If they’re the same company, it’s often one switch.
- If they’re different, the DNS provider gives you a DS record to add at the registrar.
- The risk is in changes later. Moving DNS to a new provider without updating or removing DNSSEC first can make the whole domain, website and email included, stop resolving. Turn it off before moving, then on again after.
Check yours
Our free domain check reports whether DNSSEC is on for your domain, alongside expiry, registrar and lock status.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.