DNS Security Extensions (DNSSEC) add digital signatures to DNS data. Validating resolvers check those signatures against a chain of trust that runs from the DNS root, through the TLD, down to your domain, protecting users from spoofed or tampered responses such as cache poisoning.
Enabling DNSSEC involves two steps: your DNS host signs your zone, and a DS (Delegation Signer) record is published in the parent TLD through your registrar. Many DNS providers automate this.
DNSSEC verifies authenticity but does not encrypt queries. Take care when changing DNS providers: remove or update the DS record first, or your domain can become unresolvable for validating resolvers.
Find your domain
Related terms
- TTL (Time to Live)
- TTL is the number of seconds a DNS record may be cached by resolvers before they must look it up again, affecting how fast changes take effect.
- Domain parking
- Domain parking means registering a domain without an active website, often showing a placeholder or ad page while it awaits use or sale.
- Domain flipping
- Domain flipping is buying domain names at low cost and reselling them for a profit, usually through aftermarket marketplaces or direct outreach.
- Domain aftermarket
- The domain aftermarket is where already-registered domains are bought and sold between owners, through marketplaces, brokers and auctions.