DNSSEC has two halves, and they often live with two different companies. Your DNS host signs the zone. Your registrar puts a DS record in the parent zone (.com, .in) that vouches for your key. Both halves must be in place before any resolver can validate your answers.
1. Sign the zone at your DNS host
The DNS host makes the keys (DNSKEY), signs every record set (RRSIG) and adds authenticated denial (NSEC or NSEC3). Most hosts do this with one switch:
- Cloudflare: DNS → Settings → Enable DNSSEC. Cloudflare shows the DS record to copy.
- Amazon Route 53: Hosted zone → DNSSEC signing → Enable. Route 53 needs a customer managed KMS key (asymmetric, ECC_NIST_P256) in us-east-1 as the key-signing key. Then "View information to create DS record".
- Google Cloud DNS: Zone → DNSSEC → On. The registrar setup panel shows the DS record.
- PowerDNS:
pdnsutil secure-zone example.com, thenpdnsutil show-zone example.comprints the DS lines. This site is signed this way. - BIND 9.16 and later: add
dnssec-policy default;to the zone (withinline-signing yes;for a zone file). Read the DS withdnssec-dsfromkeyon the KSK file.
After this step the zone is signed but not yet trusted. Our checker shows it as "Signed, not validating".
2. Copy the DS record
The DS record is a hash of your key-signing key. It has four fields: key tag, algorithm, digest type and digest. Use digest type 2 (SHA-256). Some registrars ask for the DNSKEY instead and compute the DS themselves.
example.com. IN DS 36114 13 2 46aea2cc97c9387566285a5de015cd30583def1b3b8cf3076bfe25f2a528b529
3. Publish the DS at your registrar
Paste the four fields into the registrar's DNSSEC form. The registrar sends them to the registry, and the DS appears in the parent zone, usually within an hour. If your DNS host and registrar are the same company (Cloudflare Registrar, Route 53 Domains), this step can be one click.
Some registries read CDS/CDNSKEY records from your zone and publish the DS for you (RFC 7344, RFC 8078). Ask your registrar whether they support it.
4. Check it
Run the checker on your domain. "Signed & validating" means a validating resolver set the AD flag. From a shell:
dig +dnssec example.com A @1.1.1.1 # look for "flags: ... ad" delv example.com A # prints "; fully validated"
Turning DNSSEC off safely
Do it in this order, or validating resolvers will return SERVFAIL for your whole domain:
- Remove the DS at the registrar.
- Wait until the old DS has expired from caches: at least the DS TTL in the parent zone (often 1 to 2 days).
- Only then turn off signing at the DNS host.
The same rule applies when you move to a new DNS host: never let the DS point at keys the new host does not serve. See troubleshooting.