How to Enable DNSSEC for Your Domain

DNS protection against forged responses. DNSSEC lets validating resolvers detect and reject forged DNS answers. Here is how to enable signing and check validation.

What this finding means

DNS protection against forged responses. DNSSEC signs DNS records so validating resolvers can detect and reject forged answers. It does not protect against registrar-account compromise, authorised DNS changes or website compromise. MyDomainRisk reports signing-record presence separately from the validating resolver observation. Unavailable validation remains unverified.

Why it matters

• DNS cache poisoning attacks are real and have been used in high-profile attacks
• DNSSEC is increasingly expected for any domain handling sensitive data
• It's a prerequisite for DANE (DNS-based Authentication of Named Entities), which provides an additional layer of TLS certificate verification
• It is treated as useful evidence by many domain security tools

How to enable DNSSEC — step by step

Enable signing with your DNS provider, then publish its DS record through your registrar to link the signatures to the parent zone. Some providers handle both steps; follow your provider’s current instructions.

Step 1: Enable DNSSEC signing at your DNS provider

If your DNS is managed by your registrar (e.g. GoDaddy, Namecheap, Cloudflare), there is usually a one-click DNSSEC toggle in the DNS management or domain settings section.

• Cloudflare: DNS → Settings → DNSSEC → Enable. Enable signing, then follow the instructions to publish the DS record at your registrar; this can be automated for supported setups.
• GoDaddy: My Products → DNS → scroll to DNSSEC → Enable
• Namecheap: Domain List → Manage → Advanced DNS → DNSSEC

Step 2: Publish the DS record in the parent zone

Once DNSSEC is enabled, your DNS provider generates a DS (Delegation Signer) record. This must be published in the parent zone (the TLD registry — e.g. .com, .co.uk). Your registrar typically handles this automatically when you enable DNSSEC. If it doesn't, you'll need to submit the DS record to your registrar manually.

Step 3: Verify the chain of trust

Once the DS record is published, check the DNSSEC chain with a validating resolver. MyDomainRisk reports signing records and the resolver’s validation observation separately: record presence alone does not prove successful validation.

Verify it worked

Review the signing-record and resolver-validation results separately. If validation could not be checked, it remains unverified; signing records alone do not establish that the chain validates.