How to turn on DNSSEC and fix a broken DNSSEC chain

DNSSEC signs your DNS records so resolvers can detect forged answers. It takes two parts: your DNS host signs the zone, and your registrar publishes a DS record in the parent zone (.com, .org and so on) that points to your key.

Turning it on

1. Turn on DNSSEC signing at your DNS host. Prefer algorithm 13 (ECDSA P-256) or 8 (RSA/SHA-256).
2. Wait until the host serves the DNSKEY records: dig +short DNSKEY example.com
3. Copy the DS record the host shows and add it at your registrar (digest type 2, SHA-256). If your DNS host is also your registrar, it may do this step for you.

   example.com.  DS  <key tag> 13 2 <SHA-256 digest, 64 hex characters>

   Publish the values your DNS host shows for your own key.
4. Check that a validating resolver now marks answers as authenticated (the ad flag):

   dig @1.1.1.1 example.com SOA +dnssec

Publish the DS last. A DS that does not match a key in the zone makes the whole domain fail to resolve for validating resolvers, mail included.

When DNSSEC is broken

The usual sign: validating resolvers such as 1.1.1.1 and 8.8.8.8 return SERVFAIL for your domain, while dig +cd (checking disabled) still gets an answer. The common cause is a DS at the registrar that no longer matches the zone, after a move to a new DNS host or after signing was turned off.

• If the zone should be signed: publish at the registrar the DS for the current key, from your DNS host.
• If it should not: delete the DS at the registrar.

Resolvers cache the old DS and keys until their TTLs run out, so the fix can take hours to reach everyone. When moving DNS hosts, remove the DS (or add the new host's DS alongside) and wait for the TTL before switching name servers.

For the full chain, see DNSViz.