What is DNSSEC?
DNSSEC (DNS Security Extensions) adds a cryptographic signature to your domain's DNS records so that a resolver can verify the answer it received is genuine and wasn't forged or tampered with in transit. It doesn't encrypt anything or hide your traffic — it protects against DNS spoofing (an attacker feeding you a fake IP for a domain). Turning it on means enabling signing at your DNS provider and publishing a matching DS record at your registrar. Several registrars we track support DNSSEC at no charge, including Cloudflare, Porkbun, and Gandi.
What DNSSEC does (and doesn't do)
Normal DNS has no built-in way to prove an answer is authentic, so an attacker positioned between you and a resolver can inject a forged record — sending users to a malicious server. DNSSEC signs each record with a private key; a validating resolver checks the signature against a public key vouched for, level by level, up to the DNS root (the chain of trust). If the signature doesn't match, the resolver rejects the answer.
What DNSSEC is not: it does not encrypt DNS queries (that's DoH/DoT), doesn't hide which sites you visit, and doesn't secure the website itself (that's TLS/HTTPS). It only guarantees the DNS answer is authentic.
How it's turned on
DNSSEC involves two places:
- At your DNS provider: enable signing, which generates the keys and signs your zone
- At your registrar: publish a DS (Delegation Signer) record — the fingerprint of your key — so the parent TLD vouches for you
- If your registrar and DNS are the same provider, this is often a single one-click toggle
When it actually matters
DNSSEC matters most for domains where a forged DNS answer would be costly — email domains, login portals, financial and government services, and anything security-sensitive. For a simple personal site the risk is lower, but since many registrars make it a free one-click option, there's little reason not to enable it. Several registrars we track document free DNSSEC support, including Cloudflare, Porkbun, and Gandi — see their profiles for details.
DNSSEC (DNS Security Extensions) cryptographically signs DNS records so validating resolvers can detect forged/tampered answers (DNS spoofing). It does NOT encrypt queries or secure the website — only authenticates DNS answers via a chain of trust from the root. Enabling it: turn on signing at the DNS provider and publish a matching DS record at the registrar (often one click when they're the same). Several tracked registrars support it free, including Cloudflare, Porkbun, and Gandi.