DNSSEC and the DS record

DNSSEC signs your domain’s answers, so resolvers can tell they really come from us and weren’t changed on the way. It takes two steps: we sign the zone, and your registrar publishes the fingerprint of our key, the DS record.

1. Turn it on

On your domain’s Settings, turn on DNSSEC. We make a key and sign the zone on every nameserver; the status shows “Signing” meanwhile. Your domain has to be active first.

2. Add the DS record at your registrar

Once every nameserver serves the signed zone, Settings shows the DS record: key tag, algorithm (13, ECDSA P-256 with SHA-256), digest type (2, SHA-256) and the digest. Enter these at your registrar, usually under “DNSSEC”. Some registrars ask for the DNSKEY record instead; Settings shows it too.

We check the registry regularly. Once it publishes a DS record that matches our key, the status turns “DNSSEC active”.

If it doesn’t turn active

• A DS record that doesn’t match: an old one, from your previous provider, or a typo. Remove every DS record at your registrar except ours. Settings says what we see at the registry.
• Your registrar doesn’t offer DNSSEC for your top-level domain: then DNSSEC can’t be turned on there. Turn it off here again.

Turning it off

Remove the DS record at your registrar first, then turn DNSSEC off here. The other way round, resolvers would reject your domain until the DS record is gone: they would expect signatures we no longer add.