Defaults.Exposed › Setup walkthroughs › DNSSEC
DNSSEC setup walkthroughs by provider
Pick the provider that hosts your DNS (Domain Name System) or sends your mail. Each page shows where the DNSSEC (Domain Name System Security Extensions) record goes in that provider's console and what to type in each box.
What the DNSSEC record does
DNSSEC signs your zone so that a resolver can prove an answer came from you and was not altered on the way. It takes two steps in two places: your DNS host signs the zone, and your registrar publishes a DS (Delegation Signer) record that points at the signing key.
The order matters. A DS record that does not match the key in the zone makes every validating resolver reject the domain, so the zone is signed first and the DS record goes in after.
DNSSEC providers
Before and after you add DNSSEC
- How to fix DNSSEC: what the record does and how a failing one is fixed.
- DNS and DNSSEC: what signing changes and what it breaks
- The DNSSEC check: pass and fail rules
- Walkthroughs for the other records