DNSSEC (Domain Name System Security Extensions) protects your domain against manipulated DNS responses. This ensures that visitors are actually directed to the servers you intended and cannot be redirected to fraudulent systems.

When someone visits your website, the visitor's router (the resolver) queries your domain's nameservers for the IP address of the server hosting your website.

But how can it be ensured that the response actually comes from your domain's authorized nameservers and has not been tampered with in transit?

This is precisely where DNSSEC comes into play. A cryptographic key pair (private and public key) is generated on your domain's nameservers. When a visitor makes a request, the following items are sent along with the response:

However, since the name server could potentially be compromised, the public key is also stored directly with your registrar within the domain management settings and sent as a "fingerprint" (digest) to the parent zone (e.g., .at, .de, .com).

Consequently, the visitor's resolver queries the parent zone's name server (e.g., the .at name server) for the fingerprint stored there for your domain. If this matches the public key received from your name server, the chain of trust is established, and the website loads. If the result does not match exactly, the connection is immediately terminated.

Currently, DNSSEC can only be used with domains that utilize external nameservers (e.g., Cloudflare).

You can find instructions on how to change your domain's nameservers in the article: How can I change the nameservers of my domain?

We will be happy to assist you with setting up DNSSEC afterwards. To do so, please send the following details provided by your nameserver provider (e.g., Cloudflare) to [email protected]:

We will configure these details for your domain and forward them to the parent zone as a digest. The DNSSEC chain of trust will then be established, enabling your domain to be resolved with DNSSEC validation.