In ordinary name resolution there is nothing in the answers that proves they came from the right place. If someone can get between you and the server, they can replace the answer with the address of their own machine. The visitor ends up somewhere else while believing they are on the right site.
DNSSEC adds a digital signature to the answers. The domain data is signed with a private key, and the resolver checks the signature with the public key.
That raises a question: how does the resolver know the public key is the right one? The answer is a chain of trust. Each level vouches for the key of the level below it. The root zone vouches for the fi zone and the fi zone vouches for an individual domain.
That vouching is called a DS record. It is a fingerprint of the domain's key, and it is stored in the zone above. A DS record is a record type of its own, much like A, CNAME, MX and TXT records, but it does not live in your own zone. It lives above it.
This is the part that surprises people most often.
Your domain's DS record is not in your DNS service. It is in the fi zone, which is maintained by the Finnish Transport and Communications Agency Traficom. Only the domain's registrar can write there.
If your DNS service is Cloudflare, for example, it handles its own side: it signs the data and publishes the keys. But it cannot write anything into the fi zone. The last link is left to the registrar.
The same division is already familiar from changing name servers. The DNS service runs the name servers, but the fact that your domain uses those particular servers is recorded in the registry. The DS record works the same way.
Sign in to your account, choose the domain and switch DNSSEC on. We take care of the signing and the registry notification for you. You can edit records in the same view, see managing DNS settings.
The change is usually visible within a few hours.
This is the most common and the most unpleasant DNSSEC mistake, so read this before you enable it.
If you remove DNSSEC from your DNS service or change DNS providers without telling us, an old DS record stays in the registry and no longer matches anything. Resolvers then reject every answer for your domain. The site does not open and email does not go through, and nothing on the server shows any sign of a fault.
Tell us in advance and we will remove the record at the same time.
DNSSEC is a genuine improvement, but it is not urgent for everyone.
It protects against forged name resolution answers. That is a real attack, but a rarer one than a break-in through an outdated publishing system, for example.
Enabling it also takes care, because a wrong setting takes the domain down completely. If you are not sure whether you need it, ask us.
