What is DNSSEC?
DNSSEC (DNS Security Extensions) adds digital signatures to DNS answers so resolvers can detect forged or tampered responses.
Why businesses care
It protects people from being silently redirected to the wrong server through DNS manipulation.
Example
A DS record at your registrar that matches the keys your DNS host uses to sign your zone.How to check
Look for a DS record at the parent zone, or run the DNSSEC checker.
How to fix
Enable signing at your DNS host, then add the DS record it provides at your registrar.
Common mistakes
- Adding a DS record before signing is active
- Removing signing without removing the DS record, which can take the domain offline
- Changing DNS host without planning the DNSSEC handover
Check it with DNSSEC Checker
Check whether a DS record exists for your domain, which indicates DNSSEC is enabled. Free DNSSEC check.
Open DNSSEC Checker