Published: 30.04.2026
DNS was designed in a time when nobody expected attackers. DNSSEC adds digital signatures to DNS answers so that a resolver can check that the answer is genuine and was not changed on the way.
What problem does it solve?
Without DNSSEC an attacker who can poison a resolver cache may send visitors to a fake copy of your website. With DNSSEC the resolver rejects any answer whose signature does not match.
How does it work?
- The DNS provider signs the records of your zone with a private key.
- The matching public key is published in the zone as a DNSKEY record.
- A fingerprint of the key, the DS record, is published in the parent zone through your registrar.
- Validating resolvers follow this chain from the root down to your domain.
How to enable it
- Enable DNSSEC for the zone in the DNS control panel of your provider.
- Copy the DS record details (key tag, algorithm, digest type and digest).
- Add the DS record at your registrar in the domain settings.
The order matters: if the DS record exists but the zone is not signed, the domain stops resolving for validating resolvers.
Do you need it?
DNSSEC is recommended for banks, shops, public services and any site where trust is critical. For a small personal site the benefit is smaller, but the setup is cheap when your provider supports it.
Risks
- Moving DNS to another provider requires removing or replacing the DS record first.
- Expired signatures make the domain unreachable, so choose a provider that renews them automatically.
Frequently asked questions
Does DNSSEC encrypt traffic? No. It proves authenticity but does not hide anything. Use HTTPS for encryption.
Does it slow the website? The impact is negligible.
