DNSSEC adds cryptographic signatures to DNS responses so resolvers can verify that records have not been tampered with. Enabling it requires signing at your DNS host and, critically, publishing a Delegation Signer (DS) record at your registrar. This guide walks through both steps.
Use the DNS tool to check whether your domain already has DNSSEC configured. You can also use dig from the command line:
dig +dnssec example.com
If DNSSEC is enabled and the chain of trust is valid, you will see RRSIG records in the answer section and the ad flag (Authenticated Data) in the response flags. If neither appears, DNSSEC is not active.
Log into your DNS provider's dashboard and enable DNSSEC. Most modern providers handle this in one click:
The provider generates a Key Signing Key (KSK) and Zone Signing Key (ZSK) and begins signing the zone records. After this step, your zone is signed, but DNSSEC-validating resolvers cannot yet verify it — the chain of trust still needs to be established at the parent zone.
This is the step that links the parent zone's trust anchor to your signed zone, and it is the step that people most often miss or do incorrectly.
Your DNS host will display a DS record (or the DNSKEY data needed to generate one) after DNSSEC signing is enabled. Copy this data exactly and enter it at your domain registrar under DNSSEC or DS record settings.
Warning: A missing, wrong, or mismatched DS record at the registrar will cause DNSSEC-validating resolvers to refuse to resolve your domain entirely — breaking access for all users whose DNS resolver enforces validation. If you perform a key rollover later, you must update the DS record at the registrar to match the new active key before the old key expires. Always validate with a tool (step 5) before considering the setup complete.
If your DNS host and registrar are the same provider (for example, your domain is registered through Cloudflare), this step often happens automatically when you enable DNSSEC signing.
The DS record is published by your registrar to the TLD registry (the parent zone), which then serves it to resolvers. Propagation time depends on the TTL of the DS record in the parent zone — typically minutes to a few hours for common TLDs.
You can check whether the DS record has appeared in the parent zone with:
dig DS example.com @a.gtld-servers.net
Replace a.gtld-servers.net with the appropriate TLD nameserver for your domain's extension. Once the DS record appears there, the chain of trust is established.
Use the DNS tool to confirm that DNSSEC validation passes for your domain. External tools like dnsviz.net provide a visual graph of the complete chain from the root zone to your domain, which is useful for diagnosing any gaps.
With dig and a validating resolver:
dig +dnssec example.com
Look for the ad flag in the flags section of the response. Its presence means a validating resolver confirmed the signatures are correct and the chain of trust from the root is intact. Do not walk away until you see this — a signed zone without a valid chain actively harms resolution for users on validating resolvers.