DNSSEC FAQ
Do all nameservers support DNSSEC?
Not all nameservers support DNSSEC. Many registrar-provided nameservers do not include DNSSEC support by default. If you wish to use DNSSEC, you may need to use custom or third-party nameservers that support it (such as Cloudflare, AWS Route 53, or Google Cloud DNS).
What TLDs are supported for DNSSEC?
DNSSEC is supported for most TLDs when using third-party nameservers. For more information on supported TLDs, refer to the registry’s official documentation.
How do I add registry-level DNSSEC records?
Please see our Managing DNSSEC guide for step-by-step instructions.
Why can’t I remove a DNSSEC record?
If you see a DNSSEC record that you cannot remove from your registrar’s panel, it may exist on your third-party nameservers rather than in your registrar’s environment. Records managed by your nameserver provider need to be deleted from their dashboard. Only records that exist in your registrar’s environment will have a Remove button. If you do not see the Remove button, contact your DNS provider to assist with the removal.
Where do I obtain my DNSSEC record/info?
DNSSEC records are generated by your DNS hosting provider (the operator of your nameservers). Contact them for the necessary DNSSEC information, including:
- Key Tag: An integer value used to identify the DNSSEC record
- Algorithm: The algorithm used to generate the signature
- Digest Type: The algorithm type used to construct the digest
- Digest: A string value generated by the algorithm
What happens if DNSSEC is misconfigured?
If DNSSEC is incorrectly configured, your domain may become completely unreachable. DNS resolvers that validate DNSSEC will refuse to resolve your domain if the signatures don’t match. Always double-check your DNSSEC configuration and test thoroughly after making changes.
How do I test if DNSSEC is working?
You can use these online tools to verify your DNSSEC configuration: