DNSSEC switched on without locking you out
We sign your DNS zone, publish the DS record through your registrar, and keep both in step whenever keys or providers change.
In plain English.
DNSSEC adds digital signatures to your DNS answers. A resolver that validates, such as Google Public DNS, Cloudflare 1.1.1.1 or Quad9, can then check that the address it was given for your domain really came from your zone and was not forged on the way. It protects against cache poisoning, where an attacker slips a false answer into a resolver.
It works as a chain of trust. Your DNS host signs the zone and publishes DNSKEY records. A DS record, a short fingerprint of your key, sits in the parent zone at Nominet for .uk or Verisign for .com, and is submitted through your registrar. Both halves must match. We usually use algorithm 13, ECDSA P-256 with SHA-256, with a SHA-256 digest in the DS record.
The risk is a mismatch. If you move DNS provider and the old DS record stays at the registry, validating resolvers return SERVFAIL and your website and email vanish for a large share of users. DNSSEC is worth having when someone looks after it, which is the part we take on.
It suits you if.
- A customer, insurer or tender has asked if your domain uses DNSSEC
- You handle payments or logins and want forged lookups ruled out
- Your DNS host supports signing but nobody has switched it on
- You need to change DNS provider on a domain that is already signed
- You want to use DANE or other records that depend on DNSSEC
What we do.
Zone signing
Signing is enabled at your DNS host, which then publishes DNSKEY and RRSIG records and re-signs automatically as records change.
DS record at the registry
We submit the key tag, algorithm, digest type and digest to your registrar, which passes the DS record to Nominet or Verisign.
Validation testing
Before and after, we test the chain with DNSViz and dig +dnssec against validating resolvers, so we catch a broken link before your customers do.
Key rollovers planned
When a key or algorithm changes, the new DS record is published and allowed to spread before the old one is withdrawn.
Safe provider moves
Changing DNS host on a signed domain is planned as a sequence, either removing the DS record first or running both providers' keys during the switch.
How it runs.
- 01
Free call
We talk about why you want DNSSEC, which domains are in scope, and where each one is registered and hosted.
- 02
Check support
We confirm the DNS host can sign the zone and the registrar can submit DS records for each extension you use.
- 03
Sign and publish
The zone is signed first and tested, then the DS record is added at the registrar, completing the chain of trust.
- 04
Keep it valid
We monitor signatures and DS records, and handle rollovers or provider moves so the chain never breaks.
Questions people ask.
Does my business need DNSSEC?
It is not required for a website to work, and many small businesses run without it. It is worth adding if you take payments or logins, if a customer or tender asks for it, or if you want to use DANE for mail. We will tell you honestly whether it is worth it for you.
Will DNSSEC slow down my website?
No noticeable amount. Signed answers are a little larger and resolvers cache the validation, so visitors will not see a difference in page load. The real cost is care: a mismatched DS record breaks resolution, which is why we monitor it.
What happens if I change DNS provider later?
The DS record at the registry must match the keys at your new provider, or validating resolvers will refuse your domain. Before any move we either remove the DS record and wait for it to expire from caches, or add the new keys first. We give you that plan in writing.
What does DNSSEC set-up cost?
It is a fixed price agreed after a free call. Most registrars and DNS hosts we use do not charge extra for DNSSEC itself. Ongoing monitoring can be included in a DNS management plan with a monthly fee agreed up front.
Your next chapter starts with a conversation.
Nottingham & Derby / UK-wideLet’s build
what’s next.
15 minutes with Garreth.
A real conversation about your business.