How to fix "DNSSEC not enabled"

If your CyberVigil report says DNSSEC isn't enabled, your domain is working normally. DNSSEC is an optional layer that signs your DNS records, and we list it as "Worth improving" rather than as a problem.

It's also one of the few settings in your report where a mistake can take your website and email offline, so read the section on what can go wrong before you turn it on. Run a scan below to see where your domain's DNS is hosted.

What does "DNSSEC not enabled" mean?

DNS is the internet's address book. When someone visits yourbusiness.com or sends you an email, their device asks a DNS resolver where to go. ICANN explains that with plain DNS, the resolver "has no way to verify the authenticity of the response," so a forged answer can send people to the wrong place.

DNSSEC (Domain Name System Security Extensions) adds digital signatures to your DNS records. Resolvers that check signatures can tell a real answer from a forged one, and they discard anything that doesn't validate.

It works in two parts. Your DNS host signs your records. Your registrar then publishes a DS (Delegation Signer) record with the registry for your domain ending, such as .com, which tells resolvers which keys to trust. Our scan looks for that DS record, and we didn't find one.

Should I turn on DNSSEC?

For most small businesses, it's a low priority. It guards against one kind of attack, forged DNS answers, and only for visitors whose resolvers check signatures. It doesn't encrypt anything. It also doesn't help if someone signs in to your registrar account, because they can change your DNS and your DS record together.

If you haven't already, do these first:

• Protect your email with an SPF record and a DMARC policy.
• Make sure your website's certificate renews automatically.
• Turn on two-step verification at your registrar and DNS host.

After that, DNSSEC is a reasonable extra if your DNS host makes it easy and you don't plan to move DNS providers soon.

What can go wrong with DNSSEC?

Two mistakes cause most problems:

1. Changing DNS hosts with DNSSEC still on. The old DS record at your registrar won't match the new host's keys. Cloudflare warns that validating resolvers then return SERVFAIL, an error that stops your domain from resolving for anyone using them. Turn DNSSEC off and remove the DS record before you move.
2. A wrong or outdated DS record. GoDaddy explains that if the DS records don't match the signatures on your nameservers, "the domain can't resolve properly."

Broken DNSSEC can also block certificate renewals. Let's Encrypt checks CAA records before every certificate it issues, and it says a SERVFAIL on that check most often means DNSSEC validation failed.

See your domain, website and email together

Run a free scan to check DNSSEC, your certificate, security headers and email protection in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I turn on DNSSEC?

Start by finding two companies. Your registrar is the one you pay for the domain. Your DNS host is wherever your nameservers point, which your registrar's dashboard shows. If they're the same company, DNSSEC is usually one toggle. If they're different, you'll copy a DS record from the DNS host to the registrar.

A DS record has four values, and they all come from your DNS host:

Choose your provider below.

How do I check that DNSSEC is working?

Wait an hour or two, then re-run your website scan. The DNSSEC result should show a DS record.

For a closer look, GoDaddy suggests free tools such as DNSViz and Verisign's DNSSEC Debugger. If either one reports an error, fix it right away or turn DNSSEC off. A broken setup can take your domain offline, while no DNSSEC at all simply leaves things as they were.

What should you do next?

• Finish the higher-priority items first: SPF, DMARC, automatic certificate renewal and two-step verification at your registrar.
• If your registrar and DNS host are the same company, turn on DNSSEC with its toggle.
• Before you ever change DNS hosts, turn DNSSEC off and remove the DS record.
• Re-run the free website scan to confirm everything resolves.