What DNSSEC means
DNSSEC helps stop attackers from secretly redirecting visitors to fake servers. It must be supported and set up at both your DNS provider and registrar. When changing DNS providers, it needs careful handling to avoid an outage.
Why it matters for your website
DNSSEC makes it much harder for attackers to send visitors to a fake copy of your site by forging DNS answers. It adds a layer of trust for sites that handle logins, payments or sensitive data. Setup is usually a few clicks if your DNS host and registrar both support it.
Example
A medical billing company turns on DNSSEC at its DNS host, then adds the matching DS record at its registrar so resolvers can verify its records.
Tips
- Check that both your DNS host and registrar support DNSSEC before starting.
- Turn off DNSSEC before moving DNS providers, then re-enable it after the move.
- Use an online DNSSEC checker to confirm the chain validates.
Common mistakes
- Switching DNS hosts with DNSSEC still on, which can make the domain unreachable.
- Adding the DS record at the registrar before signing is active at the DNS host.
Questions about DNSSEC
What is DNSSEC?
DNS Security Extensions: digital signatures on DNS records that let resolvers detect forged answers.
Does DNSSEC encrypt my DNS traffic?
No. It signs records so tampering can be detected, but it does not hide what is being looked up.
Can DNSSEC break my website?
If set up wrong, yes. A mismatched or stale DS record can cause validating resolvers to reject your domain, so changes need care.
