Learn DNSSEC

DNSSEC guides

Short, practical pages on each part of DNSSEC: the records, the keys, turning it on, and fixing it. New to DNSSEC? Start with the visual guide.

Where DNS came fromHow the Domain Name System began: the HOSTS.TXT file, Paul Mockapetris and RFC 882/883 in 1983, the first .com in 1985, ICANN, and the long road to DNSSEC and a signed root in 2010.
How domain names workThe parts of a domain name, the length rules, who is who between registry, registrar and registrant, how a name is resolved from the root down, and how non-Latin names work.
Domain extensions (TLDs)Types of top-level domains: generic, country code, sponsored, brand and IDN. India's .in and .भारत. How many TLDs are DNSSEC-signed, from our weekly check of the root zone.
How to enable DNSSECTurn on DNSSEC in three steps: sign the zone at your DNS host, copy the DS record, publish it at your registrar. Notes for Cloudflare, Route 53, Google Cloud DNS, PowerDNS and BIND.
The DS recordWhat a DNSSEC DS (Delegation Signer) record is, what its four fields mean, which digest type to use, and why it lives in the parent zone.
The DNSKEY recordWhat a DNSKEY record contains, what flags 256 and 257 mean, how the key tag is used, and how DNSKEY relates to DS and RRSIG.
The RRSIG recordWhat a DNSSEC RRSIG signature covers, what its fields mean, and why expired signatures make a domain fail with SERVFAIL.
NSEC and NSEC3How DNSSEC proves a name does not exist with NSEC and NSEC3 records, what zone walking is, and the NSEC3 settings RFC 9276 recommends.
KSK, ZSK and key rolloverWhy DNSSEC zones use a key-signing key and a zone-signing key, when one combined key is enough, and how to roll keys without breaking validation.
DNSSEC algorithmsTable of DNSSEC algorithm numbers (5, 7, 8, 10, 13, 14, 15, 16) with the RFC 8624 recommendation for signing. Which algorithm to pick for a new zone.
The AD flagWhat the Authenticated Data (AD) flag means in a DNS answer, how the DO and CD bits work, and how to test DNSSEC validation with dig and delv.
DNSSEC troubleshootingWhy a DNSSEC-signed domain returns SERVFAIL: expired signatures, a DS that points at the wrong key, a move to a new DNS host, NSEC3 settings. How to find the cause with dig and delv.