DNSSEC

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, preventing attackers from forging or modifying DNS responses. It's essential for DANE and adds an extra layer of security for all DNS-based email authentication.

How DNSSEC Works

1. Your domain's DNS records are cryptographically signed
2. Public keys are published in DNS (DNSKEY records)
3. A chain of trust extends from the root DNS to your domain
4. Resolvers verify signatures to ensure records haven't been tampered with
5. Invalid signatures cause the query to fail (secure failure)

DNSSEC Record Types

Enabling DNSSEC

DNSSEC requires support from both your DNS host and your domain registrar:

1. Enable DNSSEC at your DNS provider

   Your DNS host generates DNSKEY records and signs your zone. They provide DS record information.

2. Add DS records at your registrar

   Log into your registrar and add the DS record(s). This creates the chain of trust.

3. Verify DNSSEC is working

   Use tools like dig +dnssec or online validators.

Registrars with DNSSEC Support

Setting Up DNSSEC with Cloudflare

1. Enable DNSSEC in Cloudflare

   Go to DNS → Settings → Enable DNSSEC

2. Copy the DS record

   Cloudflare displays the DS record information you need

3. Add DS record at registrar

   Log into your registrar and add the DS record:

   # Example DS record format
   example.com. 3600 IN DS 2371 13 2 abc123def456...
   
   # Fields:
   # 2371     - Key Tag
   # 13       - Algorithm (13 = ECDSA P-256)
   # 2        - Digest Type (2 = SHA-256)
   # abc123.. - Digest value

4. Verify DNSSEC

   Wait for propagation (up to 24 hours), then verify:

   # Verify DNSSEC is working
   dig example.com +dnssec +short
   
   # Check the full chain
   dig example.com +trace +dnssec
   
   # Online validators:
   # - dnsviz.net
   # - dnssec-analyzer.verisignlabs.com

Next Steps

• DNSSEC setup with Cloudflare guide
• Set up DANE (requires DNSSEC)
• Test your DNSSEC configuration