Key facts
- DNSSEC signs DNS answers
- DS record published via the registrar to the registry
- Signing enabled at the DNS provider, such as Cloudflare
- DS record removed or replaced before any DNS provider change
- £45 an hour + VAT for set-up and checks
- Checked from a validating resolver after every change
What DNSSEC does
Ordinary DNS answers are not signed. A resolver asking for your domain's address has no built-in way to tell a genuine reply from a forged one. DNSSEC adds signatures to the answers your DNS provider gives, and links those signatures back up the chain to the registry for your extension.
Resolvers that validate DNSSEC check those signatures. If they match, the answer is used. If they do not, the resolver refuses the answer rather than risk sending someone to the wrong place.
The two halves: signing and the DS record
DNSSEC has two parts, held in two different places, and both must match:
- Signing happens at your DNS provider. In Cloudflare, for example, it is a setting on the zone.
- The DS record is a fingerprint of your signing key. It is published through your registrar to the registry, so the registry can vouch for your zone.
Most common extensions, including .uk and .com, support DNSSEC, but your registrar has to let you submit the DS record. If your domain is in the dijitul client portal, we can add it there.
Where DNSSEC goes wrong
When the DS record at the registry does not match the keys your DNS provider is using, validating resolvers treat every answer as bogus. The domain stops resolving for anyone behind those resolvers, so the website and email fail, while other people may see nothing wrong. This makes it a confusing fault to diagnose.
The usual cause is changing DNS provider while DNSSEC is still switched on. The new provider signs with different keys, or not at all, but the old DS record is still at the registry. The fix is simple once you know: remove or replace the DS record before moving DNS. We follow that order on every DNS migration.
Should your business turn it on?
| Situation | Our view |
|---|---|
| DNS hosted in Cloudflare and registrar accepts DS records | Worth enabling: low effort, managed for you |
| DNS provider changing in the next few weeks | Wait until the move is finished |
| Registrar does not accept DS records | Not possible until the domain moves registrar |
| Nobody will keep track of it | Leave it off rather than risk a mismatch later |
DNSSEC when you change registrar
Moving the domain to a new registrar is a different job from moving DNS provider, but DNSSEC still needs attention. The DS record sits at the registry and is managed through whichever registrar holds the domain. After a transfer, we check the DS record is still published and still matches the keys your DNS provider uses.
If the new registrar does not accept DS records, DNSSEC has to be switched off in a planned way: remove the DS record first, wait for cached copies to expire, then turn off signing. Doing it the other way round breaks resolution. For the transfer itself, see domain transfer.
How dijitul helps
We check your registrar and DNS provider support DNSSEC, enable signing, add the DS record, then confirm from a validating resolver that the chain works. We also note it on your account, so a future provider change follows the right order. The work is £45 an hour + VAT.
For the wider picture, see DNS management or what nameservers are. To book it in, contact us or call 01623 650333.
How it works and what it costs
Domains are priced live in the client portal. DNS management and 10 mailboxes are included with dijihost Complete Hosting at £1 a day + VAT. On their own, DNS and email set-up is £45 an hour + VAT or a fixed quote.
Tell us what you have
Your domains, who they are registered with, where your DNS and email live today, and what you want to change.
Plan the change
We list every DNS record and mailbox first, so nothing is forgotten, and agree a time to switch.
Make the switch
Transfers, nameserver changes, DNS records and mailbox moves, done carefully with low TTLs and a rollback plan.
Check it works
We test the website, email delivery, SPF, DKIM and DMARC from the outside before calling it done.
Look after it
Renewals, records and email stay looked after, and you can call a person when something changes.
Frequently asked questions
What is DNSSEC?
DNSSEC is an extension to DNS that signs the answers your DNS provider gives. A DS record held at the registry vouches for your signing key. Resolvers that validate DNSSEC check the signatures and reject answers that do not match, which protects visitors from forged DNS replies.
What is a DS record?
A DS (delegation signer) record is a fingerprint of the key your DNS provider uses to sign your zone. You submit it through your registrar, which passes it to the registry for your extension. It must match the keys your DNS provider is actually using.
Why did my domain stop working after I changed DNS provider?
If DNSSEC was on, the old DS record may still be at the registry while the new provider signs with different keys or not at all. Validating resolvers then reject every answer. Removing or replacing the DS record at the registrar fixes it, though cached results take time to clear.
Does DNSSEC encrypt my DNS?
No. DNSSEC proves that answers are genuine and unaltered, but it does not hide them. Anyone can still see which records your domain publishes. Its job is integrity, not privacy, which is why it complements rather than replaces things like HTTPS on your website.
How much does DNSSEC set-up cost?
dijitul charges £45 an hour + VAT to enable DNSSEC, add the DS record at your registrar and test it from a validating resolver. If your domain is in the dijitul client portal and your DNS is in Cloudflare, the job is usually short.
Related
Get domains, DNS and email sorted
Set up properly, records checked, and real people to call. DNS and email are included with dijihost hosting.