What DNSSEC protects against
Plain DNS answers are unsigned, so a man-in-the-middle or a poisoned resolver cache can hand out forged records — sending your visitors to an attacker's server while the domain name looks correct.
DNSSEC signs every record cryptographically and builds a chain of trust up to the DNS root. A validating resolver rejects any answer whose signature does not check out.
The two-part setup
Enabling DNSSEC always has two halves that must happen in the right order. First your DNS host signs the zone and generates the keys (DNSKEY) plus a matching DS record. Second, you publish that DS record at your registrar to link your zone to its parent.
A DS record at the registrar without matching keys in the zone — or the reverse — breaks resolution, so never publish the DS before the zone is signed.
Doing it on Cloudflare
If Cloudflare hosts your DNS:
- Open your domain, then DNS, then Settings.
- In the DNSSEC section, click Enable DNSSEC. Cloudflare signs the zone and shows a DS record.
- If the domain is registered with Cloudflare Registrar, the DS record is added at the registrar automatically — you are done.
- If it is registered elsewhere, copy the DS record (key tag, algorithm, digest type and digest) into your registrar's DNSSEC settings.
Verifying and gotchas
Once the DS record propagates, a check shows DNSKEY records present and the resolver's authenticated-data (AD) flag set. Propagation usually completes within an hour but can take longer depending on TTLs.
Do not remove signing while the DS record still exists at the registrar, and coordinate carefully if you ever change DNS host — moving a signed zone without disabling DNSSEC first will break the domain.