DNSSEC basics: what it does and how to switch it on safely
DNSSEC adds digital signatures to your domain's DNS records, so resolvers that check them can tell a real answer from a forged one that would send your visitors somewhere else. It's optional. To switch it on, enable it at your DNS provider, then add the DS record it gives you at your registrar. Turn it off at the registrar before you ever move DNS providers.
What DNSSEC protects
Cloudflare's DNSSEC docs say it makes sure "requests are not routed to a spoofed domain." The .uz registry's DNSSEC explainer describes the mechanism: "DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography," so a resolver can know "that the data hasn't been modified in transit."
It doesn't encrypt anything and doesn't replace HTTPS: HTTPS protects the connection to your site, DNSSEC protects the answer that says where your site is.
How to switch it on
DNSSEC has two halves, and both are needed:
- Sign the zone at your DNS provider. On Cloudflare: open the DNS Settings page and click Enable DNSSEC. Cloudflare then generates a DS record.
- Add the DS record at your registrar (where you bought the domain). Cloudflare notes that if your registrar doesn't list Algorithm 13, look for "ECDSA Curve P-256 with SHA-256", the same algorithm under another name.
If your registrar is also your DNS provider, there's often a single DNSSEC switch.
The mistake to avoid
A DS record at the registrar that no longer matches your DNS provider takes the domain offline for every resolver that checks DNSSEC. Cloudflare's warnings:
- Before moving nameservers to Cloudflare, disable DNSSEC at your registrar first, or "your domain will experience connectivity errors when you change your nameservers."
- When moving away, remove the DS record at your registrar first and keep signing on until the old record has expired; switching too early can make validating resolvers return SERVFAIL.
What Pewterkit Check looks at
For an app on its own domain, the check looks up a DS record for your domain. With one, DNSSEC is on; without one, it reports information that DNSSEC is off, as an optional step. It doesn't test whether the signatures validate. A DNS lookup that fails never becomes a finding.
FAQ
Do I need DNSSEC to launch?
It's optional. It's a worthwhile extra once your DNS settings are stable, especially for a domain that handles sign-ins or payments.
Can DNSSEC break my site?
Only through a mismatch between the DS record at your registrar and your DNS provider, usually after a provider change. Follow the order above and it's a one-time setup.
Does Pewterkit Check test that my DNSSEC setup works?
It looks for the DS record that shows DNSSEC is switched on. To test the signatures themselves, use your DNS provider's DNSSEC status page.
Sources
- DNSSEC (Cloudflare DNS docs) — read 27 Oct 2026
- DNSSEC – What is it and why is it important? (.uz registry) — read 27 Oct 2026
How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.