webzod
account

Turn on DNSSEC

dns.dnssec.unsigned · effort: about an hour

Why it matters

DNSSEC lets resolvers check that DNS answers for your domain were not forged. Without it, an attacker who tampers with DNS responses could send visitors to a fake site.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Check that your registrar and your DNS provider both support DNSSEC for your domain's ending. If the provider does not sign zones, moving DNS to one that does is part of the work.
  2. Stage 1, enable signing at your DNS provider. This creates the keys and gives you the DS record data. Nothing changes for resolvers yet.
  3. Before stage 2, check that every nameserver serves signed data (the second command below, run against each one, must return the DNSKEY records). One unsigned server breaks validation once the DS record is published.
  4. Stage 2, add the DS record at your registrar with the values the provider shows. This turns validation on.
  5. Wait for the DS record to be published, then confirm with a validating resolver (the ad flag on a normal answer) and run DNSViz.
  6. Know the rollback before you start. Remove the DS record at the registrar first, wait for its TTL (up to a day or two), and only then disable signing at the provider.
  7. Do not change nameserver providers while DNSSEC is on without a plan. Remove the DS record first, or use a provider that supports a hand-over.
bash 
dig +dnssec DNSKEY example.com
# run against each nameserver before adding the DS record: replace ns1.example.net with one of yours
dig +norec +dnssec @ns1.example.net DNSKEY example.com +short
dig @1.1.1.1 A example.com | grep -E "flags|status"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.