# Turn on DNSSEC (and what to do when it breaks) > DNSSEC signs your DNS answers so nobody can forge them on the way to your visitors. Source: https://infranest.io/docs/dnssec Last updated: 2026-09-18 --- DNSSEC protects your domain from being forged or tampered with on its way to visitors. This article is for anyone managing DNS in InfraNest who wants to turn it on safely — and knows what to do if it ever breaks. ## Overview - DNSSEC signs your DNS answers so nobody can fake them in transit. - It is set up in two places at once — your DNS provider and your registrar — and both need to agree. - Turned on or off the wrong way, it can take your domain off the internet entirely, so it's worth understanding before you flip the switch. ## How it works This is the part that catches almost everyone: DNSSEC is not a single setting. 1. Your DNS provider signs the zone — it generates a key and signs every answer it gives out. 2. Your registrar publishes a matching fingerprint (called a DS record) in the zone above yours, at the registry that runs your domain ending. Neither half does anything alone. Signing without the fingerprint means nobody checks the signatures. Publishing the fingerprint without signing means every check fails. > [!NOTE] > The DS record never goes in your own DNS zone — it's the one record only your registrar can publish, on the registry above you. Adding it to your own zone does nothing. That's why DNSSEC lives on the domain page next to your nameservers, not in the record editor. ## Turn on DNSSEC 1. Open the zone under **DNS**. 2. Choose **Set up DNSSEC** — you'll find it in the **Actions** menu, and also in **Mail & security** where the advisor lists improvements. 3. InfraNest asks your DNS provider to sign the zone, then hands the fingerprint to your registrar automatically where it can. 4. Check the result: - If it says **Done**, there's nothing more to do — the rest of the internet catches up within a few hours. - If it says it can't publish the fingerprint at your registrar, copy the line shown and paste it into your registrar's own control panel. - If it says your provider doesn't hand out the key, collect the fingerprint from your provider's panel and add it at your registrar yourself. - If it says your provider is still starting to sign, do nothing — InfraNest checks again every twenty minutes and finishes automatically. If **Set up DNSSEC** isn't offered at all, your DNS provider has no way to turn signing on through InfraNest (this is currently true for Hetzner and DigitalOcean). You can still do it by hand: turn signing on at your DNS provider, then open the domain in InfraNest, choose **Manage DNSSEC**, and enter what your provider gave you. ## Turn off DNSSEC 1. Open the domain and press **Turn off DNSSEC** once. 2. InfraNest removes the fingerprint at your registrar right away, and deliberately leaves the zone signed for now — this order is what keeps the domain safe. > [!WARNING] > Never remove the fingerprint and unsign the zone at the same moment. A fingerprint pointing at a key that no longer signs anything is exactly what takes a domain offline. InfraNest finishes the rest by itself, about a day later, once the old fingerprint has expired everywhere. You don't need to come back. ## Fix DNSSEC when it breaks A broken setup doesn't make your site look wrong — it makes your domain disappear. Anyone whose resolver checks DNSSEC gets no answer at all: no website, no email, no warning page. It usually happens when a key is rotated at the DNS provider without the fingerprint being updated, or after moving providers. InfraNest checks every domain for this and alerts you as soon as it starts. 1. Check the DS record at your registrar against the key your DNS provider is currently signing with — a mismatch is the usual cause. 2. If you can't fix it quickly, remove the DS record at the registrar. That turns DNSSEC off and brings the domain back for everyone almost immediately. Being unsigned beats being invisible. 3. Fix the mismatch, then put the DS record back. ## Don't add DNSKEY or DS records yourself The record editor lets you pick **DNSKEY** and **DS** as record types, but neither is how you turn DNSSEC on: - A DNSKEY is generated by your DNS provider when it signs the zone — you never type one in by hand. - A DS record belongs in the zone above yours, at the registry. One added to your own zone does nothing. InfraNest notes this beside the field if you pick either. It won't stop you, because there's one legitimate use — delegating a subdomain that's already signed elsewhere. Otherwise, use **Set up DNSSEC** next to your nameservers instead. ## Enter a key by hand Where InfraNest can't publish the fingerprint for you, open **Manage DNSSEC** on the domain page and paste the whole line your DNS provider gave you into the box at the top, rather than filling in each field separately. It reads either form: ``` 62949 13 2 FBF66B8D019C1EEC… a DS 257 3 13 mdsswUyr3DPW132mOi8V… a key ``` with or without the `example.com. 3600 IN DS` in front. InfraNest shows you what it understood before you save — and if it can't read the line, it says so rather than guessing, because a misread line publishes the wrong fingerprint, which is worse than publishing none. ## What the labels mean On the DNS zone page, next to the nameservers: - **DNSSEC on** — signed, and resolvers are validating it. Nothing to do. - **DNSSEC off** — not signed. A choice, not a fault. - **DNSSEC failing** — signed, but validation fails, so the domain doesn't resolve for most people. Act now. > [!TIP] > A label with an asterisk is based on the records InfraNest holds rather than a live check, so it can lag slightly behind what the internet actually sees.