Skip to content
IDX Cloud is live - deploy from Git in 30 secondsFree managed migration on every annual plan24/7 SupportIDX Cloud is live - deploy from Git in 30 secondsFree managed migration on every annual plan24/7 SupportIDX Cloud is live - deploy from Git in 30 secondsFree managed migration on every annual plan24/7 Support

Lesson 2 of 3

DNSSEC explained

2 min

Plain DNS has no way to prove an answer is genuine. An attacker who can inject a forged response can send your visitors anywhere. DNSSEC adds signatures to fix that.

How it works

  • Your zone is signed: each record set gets an RRSIG signature.
  • The zone publishes its public keys in DNSKEY records.
  • A DS record at the registrar links your keys to the parent zone (.com), building a chain of trust from the root down.
  • Validating resolvers check the signatures. If they don't match, the answer is rejected instead of trusted.

Turning it on

  1. Enable DNSSEC signing at your DNS provider.
  2. Copy the DS record it gives you into your registrar's DNSSEC settings.
  3. Verify with dig +dnssec yourcompany.com or an online DNSSEC analyser.

The dangerous moment is changing DNS providers. If the old DS record stays at the registrar while the new provider signs with different keys, validating resolvers treat your domain as broken. Remove DNSSEC before a provider move, and re-enable it after.

Is it worth it?

For most business sites, yes, if your provider automates key rollover. It protects against cache poisoning, and some email security standards rely on it.

PreviousZero-downtime DNS migrationsNext Debugging DNS problems