DNSSEC — Secure Your Domain With DNS Signing on EasyCloudify™
TL;DR — DNSSEC digitally signs your DNS records so browsers can verify they haven't been tampered with. Enable it from the Security page, copy the generated DS record into your domain registrar, and EasyCloudify™ activates protection once the registrar publishes it — usually within about ten minutes.
What is DNSSEC?
DNSSEC (Domain Name System Security Extensions) adds a critical layer of cryptographic protection to your domain infrastructure. It works by digitally signing your DNS records, allowing web browsers to verify that they are receiving authentic, untampered routing data. This security standard prevents malicious actors from hijacking your web traffic, redirecting users to fraudulent sites, or intercepting sensitive data.
Without DNSSEC, an attacker who manipulates DNS responses (through spoofing or cache poisoning) can silently send your visitors to a fake copy of your site. With DNSSEC enabled, resolvers reject any response that fails signature validation, so tampered records are never trusted.
Before You Start
- Your domain (zone) is connected to EasyCloudify™ and shows as active
- You have access to your domain registrar account (where you bought the domain) to add a DS record
- Your registrar and top-level domain (TLD) support DNSSEC — most modern ones do
How DNSSEC Setup Works
DNSSEC requires two parties to agree on a chain of trust:
- EasyCloudify™ signs your DNS zone and generates a DS (Delegation Signer) record.
- Your registrar publishes that DS record to the TLD so resolvers worldwide can validate your domain.
Setup is only complete once both steps are done. That's why DNSSEC shows a Pending status until your registrar publishes the DS record.
How to Enable DNSSEC
Step 1 — Open the Security page
In the sidebar, click Security to open /cloudpanel/security. Select the domain you want to protect from the zone selector at the top of the page.
Step 2 — Enable DNSSEC
Scroll to the DNSSEC card. Click Enable DNSSEC. EasyCloudify™ signs your zone and immediately generates your DS record. The status changes to Pending.
Step 3 — Copy the DS record
Click View DS Record. A panel opens with everything your registrar needs:
- DS Record — the complete record, if your registrar accepts it as a single line
- Digest — the hashed key fingerprint
- Digest Type — the hashing algorithm used (for example,
2for SHA-256) - Algorithm — the signing algorithm number (for example,
13) - Public Key — the public key for the signing key
- Key Tag — a short identifier for the key
- Flags — the key flags (for example,
257for a Key Signing Key)
Use the copy button beside each field to copy values exactly, without extra spaces.
Step 4 — Add the DS record at your registrar
Log in to your domain registrar and open the DNSSEC (or "DS records" / "Secure DNS") section for your domain. Create a new DS record and paste in the values you copied. Depending on the registrar, you'll either paste the single DS Record line or enter the Key Tag, Algorithm, Digest Type, and Digest into separate fields. Save your changes.
Step 5 — Wait for activation
Your registrar publishes the DS record to the TLD. Once EasyCloudify™ detects it, the DNSSEC status automatically changes from Pending to Active. This usually takes about ten minutes but can take up to an hour depending on your registrar.
Understanding DNSSEC Status
| Status | Meaning |
|---|---|
| Disabled | DNSSEC is not set up for this domain. |
| Pending | DNSSEC is signed and waiting for the DS record to be published at your registrar. |
| Active | The DS record is published and your domain is fully protected. |
| Disabling | DNSSEC is being turned off. |
| Error | The DNSSEC state couldn't be verified — try again or contact support. |
How to Turn Off DNSSEC
Open the DNSSEC card on the Security page and click Disable DNSSEC (or Cancel Setup if setup is still pending).
Important — Before disabling DNSSEC in EasyCloudify™, first remove the DS record from your registrar and allow it to clear. Removing the signing while the DS record still points to it can make your domain unreachable for validating resolvers.
Troubleshooting
- Status stays Pending for over an hour — Confirm the DS record at your registrar matches the values shown in View DS Record exactly, with no extra characters. Some registrars take longer to publish changes.
- Registrar asks for fields you don't see — Every value the registrar needs is in the DS record panel. Use Key Tag, Algorithm, Digest Type, and Digest for the multi-field form.
- Your TLD doesn't support DNSSEC — A small number of top-level domains don't support DNSSEC. If your registrar has no DNSSEC option, DNSSEC can't be added for that domain.
Frequently Asked Questions
Does DNSSEC encrypt my website traffic?
No. DNSSEC authenticates DNS responses so visitors reach the real address for your domain — it verifies integrity, not confidentiality. HTTPS (TLS) is what encrypts the traffic between visitors and your site.
Will enabling DNSSEC cause downtime?
Enabling DNSSEC is safe and does not interrupt your site. The only risky moment is turning it off incorrectly — always remove the DS record at your registrar before disabling DNSSEC in EasyCloudify™.
Why is DNSSEC still Pending?
DNSSEC stays Pending until your registrar publishes the DS record to the TLD. If it's been over an hour, re-check that the DS record at your registrar exactly matches the values in the DS Record panel.
Do I need to renew or rotate the DS record?
No. EasyCloudify™ manages the underlying signing keys for you. As long as the DS record at your registrar stays in place, your domain remains protected.