FmindSeparate review required
DNS signatures (DNSSEC)
DNSSEC digitally signs your domain’s DNS answers, making it harder for attackers to send your visitors or your email to a fake server. It is an extra layer of protection rather than a basic requirement.
Who can help
Whoever manages your domain’s DNS, together with your registrar
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Ask your DNS provider and registrar to compare the zone’s signing keys (DNSKEY) with the DS record at the parent and to run an independent validation of the chain. A resolver’s “authenticated” (AD) flag alone is not enough. Agree on a recovery plan before any DS or signing change.
Authoritative zone: OWNER_CONFIRMED_ZONE
DNS provider and registrar: IDENTIFY
DNSKEY, parent DS and independent chain validation: REQUEST_REVIEWWhat to do
If you want DNSSEC, ask your DNS provider and registrar whether they can enable it; many offer it as a single setting. Because a mistake can make your whole domain unreachable, let them coordinate the change and agree beforehand on how to undo it, especially when moving your DNS to another provider.
How to verify the change
Ask your DNS provider to confirm that DNSSEC validates correctly from end to end. This check can show that DNSSEC is published, not that it works.
What this check can establish
We look for a published DNSSEC link (DS record) at the parent zone but don’t validate the signatures, so even after a recheck this report cannot confirm that DNSSEC works.