DNSSEC verifies DNS answers; it does not encrypt them
DNSSEC, short for Domain Name System Security Extensions, adds cryptographic signatures to DNS. A compatible validating resolver can use those signatures to check that an answer came from the expected signed DNS zone and was not altered.
DNSSEC does not replace an SSL certificate or HTTPS, does not encrypt website or email traffic, and does not protect an infected website. These are separate security controls.
How the chain of trust works
- The DNS provider hosting the authoritative zone enables DNSSEC signing and creates the keys.
- The provider supplies a DS record containing a key tag, algorithm, digest type and digest.
- The domain owner publishes those exact values at the parent registry.
- Validating resolvers compare the parent DS record with the signed DNSKEY in the domain's DNS zone.
Do not create, guess or copy DS values from another domain. An incorrect or stale DS record can cause validating networks to return an error instead of reaching the website or delivering email.
Which UKC domains have DNSSEC Setup?
The authenticated account owner can use Domains > Manage Domain > DNSSEC Setup for an Active domain when it is:
- in the .UK namespace and assigned to UKC's Nominet registrar connection; or
- a .com, .net or .org domain assigned to Domainbox.
Other registrar and extension combinations are not currently supported and will not show the tab.
Before adding or removing a DS record
- Only add a record after the current DNS provider confirms that the zone is signed and supplies all four values.
- During a key rollover, follow the provider's sequence; the old and new records may both be needed temporarily.
- When changing nameservers or DNS provider, coordinate signing, delegation and DS records as one migration.
- Do not stop DNS signing while a valid DS record is still published unless the provider's disablement procedure tells you to do so.
If DNSSEC validation is failing, some visitors and mail systems may be unable to resolve the domain. Avoid repeated changes and contact UKC Support with the domain, nameservers and DS values supplied by the DNS provider.
Detailed instructions
Read What Is DNSSEC and How Do I Manage DS Records? for field explanations, step-by-step Client Area instructions, rollover guidance and common questions.
