Fix guide · DNS · low

DNSSEC not enabled

DNSSEC signs your DNS records so resolvers can prove an answer really came from you. Without it, an attacker who can poison a resolver's cache can send your visitors and email to their own servers. It takes two steps: your DNS host signs the zone, and your registrar publishes a DS record that links your domain to that signature.

Time to fix

10 minutes, then up to 24 hours to take effect

Risk if ignored

DNS spoofing and cache poisoning

Breaks anything?

Only if the DS record is wrong: then the domain stops resolving, so copy it exactly

How to fix it

DNS → Settings → DNSSEC → Enable DNSSEC. Cloudflare shows the DS record:

Key tag: 2371
Algorithm: 13
Digest type: 2
Digest: (long hex string)

If the domain is registered at Cloudflare, it is added for you. Otherwise copy these values into the DS record form at your registrar.

Find "DNSSEC" or "DS records" in the domain's settings (GoDaddy: DNS → DNSSEC; Namecheap: Advanced DNS → DNSSEC) and add the record from your DNS host:

Key tag:     2371
Algorithm:   13 (ECDSA P-256 SHA-256)
Digest type: 2 (SHA-256)
Digest:      paste exactly as shown

Some registrars ask for the public key (DNSKEY) instead; your DNS host shows that too.

Hosted zone → DNSSEC signing → Enable DNSSEC signing (creates a key in KMS, us-east-1):

Then: View information to create DS record → copy the DS record

Add it at your registrar. If the domain is registered in Route 53: Registered domains → DNSSEC status → Manage keys.

Turn on signing for the zone:

gcloud dns managed-zones update ZONE_NAME --dnssec-state on\ngcloud dns dns-keys list --zone ZONE_NAME

Copy the key-signing key's DS record to your registrar.

After the registrar change, from any terminal:

dig DS yourdomain.com +short
dig yourdomain.com +dnssec

The first shows your DS record; the second should show RRSIG signatures. DNSViz (dnsviz.net) draws the whole chain.

Moving DNS to another provider later? Remove the DS record at the registrar first, wait a day, then move. A stale DS record makes the domain unreachable.

Check your fix

Common mistakes

Turning on signing at the DNS host but never adding the DS record at the registrar, so nothing is actually protected.
Mistyping the digest or picking the wrong algorithm number. Copy and paste every value.
Switching DNS providers with the old DS record still in place.