Turn on DNSSEC (and what to do when it breaks)

DNSSEC adds a digital signature to your domain's DNS answers so nobody can forge them on the way to your visitors. This article is for anyone turning DNSSEC on, off, or fixing it when it's gone wrong.

#Overview

• DNSSEC is worth having, but it is the one DNS setting that can take your domain off the internet entirely if it's set up wrong.
• It's controlled from two different places working together: your DNS provider and your registrar.
• InfraNest shows its status on the DNS Zone page, next to your nameservers — not in the record editor.

#Understand the two places it's set

This is the part that trips almost everyone up.

1. Your DNS provider signs the zone — it generates a key and signs every answer it gives out.
2. Your registrar publishes a short fingerprint of that key, called a DS record, in the zone above yours (at the registry that runs your domain ending, like .com or .nl).

Neither step does anything by itself. Signing without the DS means nobody checks the signatures; having a DS without signing means every check fails.

NoteThe DS record does not go in your own DNS zone — it's the one DNS record you can't publish yourself. That's why it goes through your registrar, and why InfraNest shows DNSSEC next to your nameservers rather than in the record editor.

#Turn on DNSSEC

1. Open the zone under DNS.
2. Choose Set up DNSSEC — you'll find it in the Actions menu, and also in Protection where the advisor lists improvements.
3. InfraNest does both steps for you where it can: it asks your DNS provider to sign the zone, then hands the fingerprint to your registrar.
4. Check the result:
   • Done — nothing more to do; the rest of the internet catches up within a few hours.
   • We cannot publish the fingerprint for you at this registrar — copy the line shown and paste it into your registrar's own control panel.
   • This provider does not hand out the key — pick up the fingerprint from your provider's panel, then add it at your registrar.
   • Your provider is still starting to sign — nothing to do; InfraNest checks again every twenty minutes and publishes the fingerprint once ready.

If Set up DNSSEC isn't offered at all, your DNS provider has no way to switch signing on through their connection to InfraNest — this is currently true for Hetzner and DigitalOcean.

You can still do it by hand: turn signing on at your DNS provider, then open the domain in InfraNest, choose Manage DNSSEC, and enter what your provider gave you.

#Turn off DNSSEC

1. Press Turn off DNSSEC once.
2. This removes the fingerprint at your registrar first and deliberately leaves the zone signed — that's the safe order. Doing both at the same moment would leave a fingerprint pointing at a key that no longer signs anything, which is what takes a domain offline.
3. InfraNest finishes the rest by itself, about a day later, once the old fingerprint has expired everywhere. You don't need to come back.

#Enter a key by hand

1. Where InfraNest can't publish the fingerprint for you, open Manage DNSSEC on the domain page.
2. Paste the whole line your DNS provider gave you into the box at the top, rather than filling in each field separately. It reads either form:

62949 13 2 FBF66B8D019C1EEC…          a DS
257 3 13 mdsswUyr3DPW132mOi8V…        a key

3. This works with or without the example.com. 3600 IN DS part in front. InfraNest tells you what it understood before you save — if it can't read the line, it says so rather than guessing, since a misread line publishes the wrong fingerprint, which is worse than publishing none.

#When DNSSEC breaks

A broken setup doesn't make your site look wrong — it makes your domain disappear. Anyone whose resolver checks DNSSEC gets no answer at all: no website, no email, no warning page to click through. It usually happens when a key is rotated at the DNS provider without the DS being updated, or after moving a domain between providers.

InfraNest checks every domain for this and alerts you as soon as it starts, because nothing in your own systems will show this failing.

If you get that alert:

1. Check the DS record at your registrar against the key your DNS provider is currently signing with — a mismatch is the usual cause.
2. If you can't fix it quickly, remove the DS record at the registrar. That turns DNSSEC off and brings the domain back for everyone, almost immediately. It's better to be unsigned than invisible.
3. Fix the mismatch, then put the DS record back.

#Don't add DNSKEY or DS records yourself

The record editor lets you choose DNSKEY and DS as record types, but neither is how you switch DNSSEC on:

• A DNSKEY is generated by your DNS provider when it signs the zone — you never type one in yourself.
• A DS record belongs in the zone above yours, at the registry. One added to your own zone does nothing at all.

InfraNest explains this beside the field if you pick either type. It won't stop you, because there's one real use for it: delegating a subdomain that someone else has already signed. If that's not what you're doing, use Set up DNSSEC beside your nameservers instead.

#What the status labels mean

On the DNS zone page, next to the nameservers, you'll see one of:

• DNSSEC on — signed, and resolvers are validating it. Nothing to do.
• DNSSEC off — not signed. This is a choice, not a fault.
• DNSSEC failing — signed, but validation fails, so the domain doesn't resolve for most people. Act now.

WarningA label with an asterisk is based on the records InfraNest holds rather than a live check, and can be out of step with what the internet actually sees.

#Tips

TipIf you're ever unsure whether DNSSEC is causing a problem, removing the DS record at the registrar is the fast, safe fix — it brings the domain back immediately, and you can re-add it once the real issue is sorted.