DNSSEC

DNSSEC protects your domain's DNS answers with a digital signature, so visitors' computers can check that an answer really comes from your domain's nameservers and was not forged on the way. It can be turned on for domains registered with us.

Turning it on

Open the domain on the Domains page and find the DNSSEC card.

If our nameservers serve the zone, it is one button: we sign the zone and pass the required DS record to the registry ourselves.

If another nameserver serves the zone, the zone has to be signed at your DNS provider. Then copy the DS record from there into the card's form, exactly as their panel shows it.

Things to watch

• Turn DNSSEC off before changing nameservers, and wait until the DS record has gone from the registry. If the domain moves to a nameserver that does not sign with the same key, validating resolvers treat the domain as unreachable.
• If another provider signs the zone and rolls its key, update the DS record with us as well.
• DNSSEC authenticates, it does not encrypt. HTTPS encrypts your website's traffic: SSL certificates and HTTPS.