What DNSSEC protects against
Every visit to your website and every email sent to you starts with a DNS lookup. Plain DNS answers aren't signed, so an attacker who can intercept or poison them can point your domain at their own server. DNSSEC (Domain Name System Security Extensions) adds digital signatures to your records, so resolvers that validate DNSSEC throw away answers that have been tampered with.
How it fits together
DNSSEC works as a chain of trust with two halves, and both must be in place:
- Your DNS host signs your zone. It publishes the keys (
DNSKEY) and a signature (RRSIG) for each set of records. - Your registrar publishes a DS record in the parent zone, such as
.com. It's a fingerprint of your key that links your domain into the chain.
Our free check looks for that DS record. If there isn't one, DNSSEC isn't active for your domain, whatever your DNS host's settings say.
Enabling DNSSEC
- Cloudflare DNS: open your domain, go to DNS, Settings, and enable DNSSEC. If Cloudflare is also your registrar, the DS record is added for you. Otherwise copy the DS details into your registrar's DNSSEC settings.
- Other DNS hosts: turn on zone signing first, then add the DS record they give you at your registrar. Some registrars pick it up automatically.
Allow a day for the change to settle, then run the check again.
The one way DNSSEC can hurt you
If you move your DNS to a new provider while the old DS record is still at the registrar, validating resolvers will reject your new answers and your domain will look offline to much of the internet. Before moving DNS, remove the DS record (or swap in the new provider's), wait at least a day for caches to expire, then switch.
Is it worth it for a small business?
DNSSEC is defence in depth rather than an emergency, which is why our check marks a missing DS record as low severity. If your DNS host makes it one click, it's worth turning on. Fix email spoofing first: it's far more likely to be used against you.
CAA records: the other DNS check
A CAA record lists the certificate authorities allowed to issue HTTPS certificates for your domain. Without one, any public authority may issue. Adding one is low-risk and takes a minute:
example.com CAA 0 issue "letsencrypt.org"List every authority you actually use (your host or CDN documents which). The free check reports when no CAA record exists.