# DNSSEC Setup and Management

Source: https://dijituldns.co.uk/dnssec/
Updated: 2026-10-18

> DNSSEC adds digital signatures to your DNS answers so resolvers can tell they have not been tampered with. dijitul enables signing at your DNS provider, publishes the matching DS record through your registrar, and keeps the two in step when anything changes. DNSSEC set-up and checks are £45 an hour + VAT.

Price: £45 an hour + VAT

## Key facts

- DNSSEC signs DNS answers
- DS record published via the registrar to the registry
- Signing enabled at the DNS provider, such as Cloudflare
- DS record removed or replaced before any DNS provider change
- £45 an hour + VAT for set-up and checks
- Checked from a validating resolver after every change

## What DNSSEC does

Ordinary DNS answers are not signed. A resolver asking for your domain's address has no built-in way to tell a genuine reply from a forged one. DNSSEC adds signatures to the answers your DNS provider gives, and links those signatures back up the chain to the registry for your extension.

Resolvers that validate DNSSEC check those signatures. If they match, the answer is used. If they do not, the resolver refuses the answer rather than risk sending someone to the wrong place.

## The two halves: signing and the DS record

DNSSEC has two parts, held in two different places, and both must match:

- **Signing** happens at your DNS provider. In Cloudflare, for example, it is a setting on the zone.
- **The DS record** is a fingerprint of your signing key. It is published through your registrar to the registry, so the registry can vouch for your zone.

Most common extensions, including .uk and .com, support DNSSEC, but your registrar has to let you submit the DS record. If your domain is in the [dijitul client portal](https://clients.dijitul.uk), we can add it there.

## Where DNSSEC goes wrong

When the DS record at the registry does not match the keys your DNS provider is using, validating resolvers treat every answer as bogus. The domain stops resolving for anyone behind those resolvers, so the website and email fail, while other people may see nothing wrong. This makes it a confusing fault to diagnose.

The usual cause is changing DNS provider while DNSSEC is still switched on. The new provider signs with different keys, or not at all, but the old DS record is still at the registry. The fix is simple once you know: remove or replace the DS record **before** moving DNS. We follow that order on every [DNS migration](https://dijituldns.co.uk/dns-migration/).

## Should your business turn it on?

| Situation | Our view |

| DNS hosted in Cloudflare and registrar accepts DS records | Worth enabling: low effort, managed for you |
| DNS provider changing in the next few weeks | Wait until the move is finished |
| Registrar does not accept DS records | Not possible until the domain moves registrar |
| Nobody will keep track of it | Leave it off rather than risk a mismatch later |

## DNSSEC when you change registrar

Moving the domain to a new registrar is a different job from moving DNS provider, but DNSSEC still needs attention. The DS record sits at the registry and is managed through whichever registrar holds the domain. After a transfer, we check the DS record is still published and still matches the keys your DNS provider uses.

If the new registrar does not accept DS records, DNSSEC has to be switched off in a planned way: remove the DS record first, wait for cached copies to expire, then turn off signing. Doing it the other way round breaks resolution. For the transfer itself, see [domain transfer](https://dijituldns.co.uk/domain-transfer/).

## How dijitul helps

We check your registrar and DNS provider support DNSSEC, enable signing, add the DS record, then confirm from a validating resolver that the chain works. We also note it on your account, so a future provider change follows the right order. The work is **£45 an hour + VAT**.

For the wider picture, see [DNS management](https://dijituldns.co.uk/dns-management/) or [what nameservers are](https://dijituldns.co.uk/guides/what-are-nameservers/). To book it in, [contact us](https://dijituldns.co.uk/contact/) or call [01623 650333](tel:01623650333).

## FAQs

### What is DNSSEC?

DNSSEC is an extension to DNS that signs the answers your DNS provider gives. A DS record held at the registry vouches for your signing key. Resolvers that validate DNSSEC check the signatures and reject answers that do not match, which protects visitors from forged DNS replies.

### What is a DS record?

A DS (delegation signer) record is a fingerprint of the key your DNS provider uses to sign your zone. You submit it through your registrar, which passes it to the registry for your extension. It must match the keys your DNS provider is actually using.

### Why did my domain stop working after I changed DNS provider?

If DNSSEC was on, the old DS record may still be at the registry while the new provider signs with different keys or not at all. Validating resolvers then reject every answer. Removing or replacing the DS record at the registrar fixes it, though cached results take time to clear.

### Does DNSSEC encrypt my DNS?

No. DNSSEC proves that answers are genuine and unaltered, but it does not hide them. Anyone can still see which records your domain publishes. Its job is integrity, not privacy, which is why it complements rather than replaces things like HTTPS on your website.

### How much does DNSSEC set-up cost?

dijitul charges £45 an hour + VAT to enable DNSSEC, add the DS record at your registrar and test it from a validating resolver. If your domain is in the dijitul client portal and your DNS is in Cloudflare, the job is usually short.

## Prices and contact

Domains are priced live in the client portal. DNS management and 10 mailboxes are included with dijihost Complete Hosting at £1 a day + VAT. On their own, DNS and email set-up is £45 an hour + VAT or a fixed quote. Domain search and registration: https://clients.dijitul.uk. Hosting: https://dijihost.co.uk/ (£1 a day + VAT). Contact: https://dijituldns.co.uk/contact/ · 01623 650333 · info@dijitul.uk