What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a set of security extensions for the Domain Name System that allows DNS responses to be cryptographically verified.

In practice, DNSSEC protects your domain against attacks such as DNS cache poisoning and DNS spoofing, preventing users from being redirected to fraudulent websites due to manipulated DNS responses.

It is important to note that DNSSEC does not encrypt network traffic (this is the role of SSL/TLS certificates). Instead, it ensures that the DNS information received by clients is authentic and has not been modified in transit.

Is DNSSEC available for every domain extension?

No.

DNSSEC availability depends on the Registry responsible for the specific top-level domain (TLD).

For example, DNSSEC is available for extensions such as:

• .com
• .net
• .org
• .info
• .eu

Some extensions do not currently support DNSSEC, including:

• .it
• .ae
• .hk
• .hu

The list of supported extensions may change over time according to the policies of the respective Registries.

Can I use DNSSEC with external nameservers?

Yes.

For all domain extensions that support DNSSEC, it can be used whether your domain is configured to use:

• DomainRegister nameservers;
• External nameservers.

The activation procedure differs depending on your configuration.

Domain registered with DomainRegister using our nameservers

To enable or disable DNSSEC, simply open a support ticket specifying:

• the domain name;
• whether you want to enable or disable DNSSEC.

Our technical staff will configure DNSSEC and update the Registry accordingly.

Domain registered with DomainRegister using external nameservers

In this case, the DS record is generated by the provider operating the authoritative nameservers.

To request the activation, update or removal of DNSSEC, please open a support ticket including:

• the domain name;
• whether you wish to enable, update, or disable DNSSEC;
• the DS record using the following format:

<keytag> <algorithm> <digestType> <digest>

The individual fields are defined as follows:

The DS record is normally provided by the operator of the authoritative nameservers or can be generated directly by the DNS software managing the DNSSEC keys.

Fees

Since every DNSSEC operation requires manual processing at the Registry level, each request is subject to a one-time fee of €13.50.

This fee applies to:

• DNSSEC activation;
• DS record updates;
• DNSSEC removal.

Will enabling DNSSEC affect DNS zone management?

No.

Enabling DNSSEC does not affect the day-to-day management of your DNS zone.

You may continue to add, modify or remove DNS records (A, AAAA, MX, TXT, CNAME, etc.) at any time without requiring any DNSSEC-related changes.

Routine DNS zone updates do not require the DS record to be updated.

The DS record only needs to be changed when the DNSSEC signing keys are replaced, for example during a key rollover or after migrating to another DNS provider.

Domain transfers

Before transferring a domain to another Registrar, it is strongly recommended to disable DNSSEC.

Doing so minimizes the risk of DNS validation failures during the transfer process and allows the new Registrar or DNS provider to configure DNSSEC correctly once the transfer has been completed.

If you wish to continue using DNSSEC after the transfer, it can be re-enabled according to the procedures supported by your new Registrar.

Frequently Asked Questions

Does DNSSEC make my website more secure?

Yes, but in a different way than an SSL/TLS certificate.

DNSSEC protects the DNS resolution process by ensuring that DNS responses are authentic and have not been tampered with. This reduces the risk of users being redirected to fraudulent websites through DNS-based attacks.

It does not protect the communication between the visitor's browser and the web server.

Does DNSSEC replace an SSL certificate?

No.

DNSSEC and SSL/TLS provide two different and complementary security functions.

• DNSSEC verifies the authenticity of DNS responses.
• SSL/TLS encrypts the communication between the user's browser and the server, ensuring confidentiality and data integrity.

For maximum security, both technologies should be used together.

Does DNSSEC make my website faster?

No.

Enabling DNSSEC does not improve website performance.

DNSSEC validation introduces a very small amount of additional processing, which is generally imperceptible to end users. Its purpose is to improve DNS security, not website speed.

Do I need to update DNSSEC every time I change a DNS record?

In almost all cases, no.

You may freely modify your DNS zone (A, AAAA, MX, TXT, CNAME, SPF, and other records) without updating the DS record stored at the Registry.

The DS record only needs to be updated when the DNSSEC signing keys change, for example during a key rollover or after migrating to a different DNS provider.