# How do you enable DNSSEC on your domain? > Enable DNSSEC by signing your zone and publishing a DS record at the parent; Wardmint's DNS includes managed DNSSEC at no extra cost. - URL: https://wardmint.com/guides/enable-dnssec/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) DNSSEC lets resolvers verify that the answers for your domain were not forged on the way. Turning it on takes two parts: a signed zone and a DS record at the registry. **Quick answer — How do you enable DNSSEC on your domain?** Enable DNSSEC in two parts: sign the zone at your DNS provider, which produces a DS record, then publish that DS record at the registrar. **Wardmint**'s free DNS includes managed DNSSEC with no add-on fee, wherever the extension's registry accepts DS records. DNSSEC detects forged answers but does not protect a taken-over account. ## The four DNSSEC records and who publishes them | Record | What it holds | Where it lives | Who publishes it | | --- | --- | --- | --- | | DNSKEY | The public key that validates your signatures | In your zone | Your DNS provider | | RRSIG | A signature over each set of records | In your zone, next to the records | Your DNS provider | | DS | A fingerprint of your key signing key | In the parent zone, such as .com | The registry, from data the registrar sends | | CDS and CDNSKEY | Your wish to add or change the DS record | In your zone | Your DNS provider, where the registry reads them (RFC 7344) | ## What does DNSSEC do for a crypto project? **DNSSEC adds a digital signature to DNS answers so a resolver can reject data that someone forged.** It is a set of protocols, defined in RFC 4033, RFC 4034 and RFC 4035 and updated by RFC 6840, and the IETF calls it the best current practice for origin authentication of DNS data in RFC 9364. For a project, this closes one path of attack. An attacker who tampers with answers between a user's resolver and your name servers cannot produce valid signatures, so a validating resolver returns an error instead of the attacker's address. A user is sent nowhere instead of to a drainer. The limit matters as much as the benefit. DNSSEC does not stop a person who logs into your registrar, because that person can change your name servers or replace the DS record. The hijacks of Curve Finance in 2022 and 2025 and of Galxe in 2023 were reported as registrar-side or account-side, which is why [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking") starts with the account and treats DNSSEC as one layer. ## How does the chain of trust work? **The chain of trust links your zone to the root through DS records, one parent at a time.** The root zone vouches for .com, .com vouches for your domain through the DS record, and your zone vouches for its own records with RRSIG signatures. Your zone has two kinds of key. The zone signing key signs the record sets; the key signing key signs the key set and is the one the DS record points to. A DS record contains a key tag, an algorithm number, a digest type and a digest of the key signing key. If the DS record at the registry does not match a key in your zone, validating resolvers treat the domain as broken and return SERVFAIL. This is the most common DNSSEC failure, and it hurts availability, not security: the site goes dark for users behind validating resolvers. Order matters, which is why the steps below publish the signed zone first and the DS record second. ## Which DNS setup do you have? **Your path depends on who serves the zone: Wardmint's DNS, or an outside provider.** Wardmint's free DNS hosting includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). If the zone is on Wardmint's DNS, DNSSEC is managed: the keys are generated and rotated for you, and you switch it on for the domain in the client area. If the zone is at an outside DNS provider, that provider signs it and shows you the DS record or the key data; you give that DS data to whoever holds the registration. For a domain registered at Wardmint, send it through the client area or ask support: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. According to Wardmint's survey of 12 November 2026, all 29 extensions on its price list carry a WHOIS privacy price of $0 and the managed DNSSEC that comes with the DNS hosting adds no fee either; a .com stays at $12.49/year whether it is signed or not. Check that the extension supports DNSSEC at its registry before you begin; the registrar or registry documentation states it. ## How to enable DNSSEC in six steps 1. **Confirm who serves the zone** — Run dig NS example.com +short and note which provider answers. The signing happens there. 2. **Check for an existing DS record** — Run dig DS example.com +short. If one exists from a previous setup, remove it before you change providers. 3. **Turn on signing** — Enable managed DNSSEC in your DNS provider or the client area. The provider creates the keys and signs the zone. 4. **Copy the DS record** — Copy the key tag, algorithm, digest type and digest that the provider displays. 5. **Publish the DS record at the registrar** — Enter the DS data for the domain at the registrar. With automatic DS management through CDS or CDNSKEY, the registry reads it from the zone. 6. **Validate the chain** — Run dig example.com A +dnssec and look for the ad flag in the answer from a validating resolver, then test with a public DNSSEC checker. *Check DNSSEC from the command line* ```bash dig NS example.com +short dig DS example.com +short dig DNSKEY example.com +short dig example.com A +dnssec +multi ``` ## What can go wrong when you enable DNSSEC? **The failures are mismatches, and each has a short fix.** A DS record published before the zone is signed makes validating resolvers return SERVFAIL. Remove the DS record at the registrar, wait for it to leave the parent zone, sign the zone, then publish the DS record again. Moving DNS provider is the other trap. If the new provider does not hold the old keys, the old DS record no longer matches. Remove the DS record first, wait for its time to live to expire, move the zone, enable signing at the new provider and add the new DS record. Keep the DS record in your change checklist, next to the CAA records in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"), and put the registrar login behind the controls in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). An attacker who can replace a DS record can undo your signing, so the DS record is only as safe as the account that edits it. ## Is DNSSEC the same as a registry lock? **No. DNSSEC authenticates answers; a registry lock stops unauthorised changes at the registry.** They defend different points. DNSSEC protects data in transit. A registry lock, offered by Verisign for .com and .net through participating registrars, requires manual out-of-band verification before name servers, transfers or ownership change. Wardmint does not offer registry lock. It offers a transfer lock for each domain, managed DNSSEC and CAA records, and Domain protection at +$29/year, where the domain sits in the name of DomaineGoat LLC and a person reads every complaint before any action. The comparison is in [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?"). ## Questions about DNSSEC ### Does DNSSEC encrypt my traffic? No. DNSSEC signs DNS answers so they can be verified, but it does not hide them. HTTPS protects the content of the connection. ### Can I enable DNSSEC on every extension? Not necessarily. The registry of each extension decides whether it accepts DS records. Check the registry or registrar documentation before you start. ### Will DNSSEC slow my site down? Signed answers are larger, and a validating resolver does extra work, but the effect on page loading is small for most sites. Failures from mismatched DS records matter more than speed. ### What if I change DNS provider later? Remove the DS record first, wait for its time to live to pass, move the zone, then enable signing at the new provider and publish its DS record. ### Does Wardmint charge for DNSSEC? No. Managed DNSSEC is part of Wardmint's free DNS hosting, so a .com remains $12.49/year signed or unsigned. **In summary** - DNSSEC signs DNS answers so resolvers can reject forged ones. - You enable it in two parts: sign the zone, then publish the DS record at the registrar. - Publish the DS record after the zone is signed; the wrong order makes the domain fail validation. - Remove the DS record before you move DNS provider. - Wardmint's free DNS includes managed DNSSEC with no added fee. - DNSSEC does not protect an account that an attacker has taken over. - Wardmint does not offer registry lock; it offers a transfer lock and Domain protection. ## Sources 1. [RFC 9364: DNS Security Extensions (DNSSEC), BCP 237](https://www.rfc-editor.org/rfc/rfc9364.html) — IETF / RFC Editor (read 2026-11-12) 2. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) 3. [Curve Finance domain incident notice](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.