Defaults.Exposed › Setup walkthroughs › DNSSEC › REG.RU

How to enable DNSSEC on Reg.ru

Two conditions have to hold before the DNSSEC (Domain Name System Security Extensions) option appears at Reg.ru at all: the paid Premium DNS (Domain Name System) service has to be active on the domain, and the domain has to be delegated to ns1.reg.ru and ns2.reg.ru. If either is missing, there is no switch to find, and hunting for it is wasted time.

What DNSSEC does

DNSSEC proves a DNS answer is genuine and unaltered. It does not encrypt your DNS traffic, your email or your website, and it does nothing about DDoS.

The chain has two halves. The DNS host signs the zone and publishes a key; the registry holds a DS (Delegation Signer) record fingerprinting that key, lodged through the registrar. A validating resolver checks the chain from the root down, and when the halves disagree it refuses the domain rather than serving an unverified answer.

The October 2026 census found 23,390,098 domains (7.0%) signed and valid, and 265,080 (0.08%) signed and broken.

Confirm who answers DNS before you touch anything

Check the domain’s assigned nameservers in the Reg.ru console before doing anything else. DNSSEC only works when the domain is delegated to ns1.reg.ru and ns2.reg.ru. If the domain instead shows ns1.hosting.reg.ru, ns2.hosting.reg.ru, ns5.hosting.reg.ru or ns6.hosting.reg.ru, the DNSSEC option will not be available, because those hosting nameservers do not support it.

Reg.ru is the registrar and, when the domain uses its own nameservers, the DNS host for this record. It offers DNSSEC signing as a feature of a paid add-on rather than the free DNS service, and where an external host signs the zone instead, Reg.ru only carries the resulting keys through to the registry.

Switch it on

1. Sign in to the Reg.ru personal account, labelled «личный кабинет».
2. Open the «Домены» (Domains) section from the account menu.
3. Click the row for the domain to open its management page.
4. Confirm the «Премиум DNS» (Premium DNS) service shows as active for the domain, and order it first if it does not.
5. In the «DNS-серверы и управление зоной» (DNS servers and zone management) block, click «Изменить» (Edit).
6. Open the «Управление» (Management) tab and find the DNSSEC field, which shows the current status.
7. Switch the DNSSEC toggle on and confirm the change.

Where an external host signs the zone instead, open the domain’s DNSSEC section and click «Добавить ключи» (Add keys) rather than switching Reg.ru’s own toggle on.

There is no record value to enter on either path. When DNSSEC is switched on through the nameserver path, Reg.ru signs the zone and lodges the DS and key material with the registry on its own, with nothing to copy or paste. When «Добавить ключи» is used, Reg.ru retrieves the DNSKEY (DNS Public Key) records from the zone’s authoritative server automatically, so that action has no fields either. The DNSSEC field on the «Управление» tab is a status toggle, on or off, with no host or content to type.

Things that trip people here

• DNSSEC at Reg.ru comes bundled with the paid «Премиум DNS» service rather than the free DNS, so it will not appear as an option until that service is active on the domain.
• The toggle only shows up when the domain is delegated to ns1.reg.ru and ns2.reg.ru. Domains left on the hosting nameservers do not get the option at all.
• Only a set list of zones is supported: at the last check of Reg.ru’s help that was .ru, .su, .рф, .com, .net and .name, with Reg.ru noting the list will be expanded, so confirm current support in the console rather than trusting an older list.
• If an external DNS host already signs the zone, lodge its keys through «Добавить ключи» only. Also switching on Reg.ru’s own signing double-signs the zone.
• Before moving DNS away from Reg.ru’s nameservers, disable DNSSEC first and let the change apply, then move. Stale keys left at the registry keep demanding signatures that no longer exist and lookups fail.

Why the TLD list matters

That restriction to specific zones comes from how DNSSEC reaches the registry, and it decides whether this is possible at all for your domain.

A DS record has to be accepted by the registry that runs your TLD (Top-Level Domain), and it travels there through your registrar using whatever interface that registry provides. Most large TLDs support it. Some smaller or country-specific ones do not, or do so through a process a given registrar has not implemented. When the registry or the path is missing, no amount of signing at the DNS host produces a validated domain, because nothing publishes the fingerprint upward.

The practical test is whether the option appears in the console for your particular domain. If it does not, check the nameservers and the Premium DNS status first, since those are the two conditions under your control, and only then conclude that the TLD is the obstacle.

Wait, then confirm

The toggle takes effect within minutes, and the saved status appears back on the «Управление» tab where the DNSSEC field was found. Full propagation of the change across the wider DNS can take up to a day.

How the scan grades this record: the DNSSEC check, with its pass and fail rules and how many domains pass it.

Return to the «Управление» tab and check the DNSSEC field shows as active once the toggle has been confirmed, or once the registry has accepted the keys added through «Добавить ключи». Then confirm with an outside check, since the console’s own status line cannot prove the chain validates.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.