Skip to content
0333 090 4540
Snappyhost

Enable DNSSEC

Sign the DNS zone and publish the matching DS record with the registrar.

Where Domains → Manage → DNSSEC

Enhance DNSSEC section with the DNSSEC switch and registrar warning visible

What this is for

  • Protect DNS answers with cryptographic validation.
  • Coordinate the zone signing key with the parent zone.
  • Avoid a broken chain of trust.

Before you start

  • Confirm the domain registrar supports DNSSEC and you can edit DS records there.
  • Plan a maintenance window for an important domain because an incorrect DS record can break all DNS lookups.

Take care

An incorrect or stale DS record can make the entire domain fail DNSSEC validation.

Steps

  1. 1

    Confirm the registrar supports DNSSEC and allows DS record management.

  2. 2

    Open Websites, select the correct website, choose Domains and open the exact domain you want to protect.

  3. 3

    Choose DNSSEC in the left-hand section menu. Read the explanation and make sure the registrar step can be completed before touching the switch.

  4. 4

    Turn on the DNSSEC switch and wait for Enhance to generate the DS details.

  5. 5

    Copy every generated DS value exactly, including key tag, algorithm, digest type and digest.

  6. 6

    Add those values as a DS record at the domain registrar; this is not an ordinary DNS-zone record inside Enhance.

  7. 7

    Wait for publication and validate the chain with a DNSSEC checker.

  8. 8

    Before disabling or changing keys, remove or update the parent DS record in the correct order.

Check it worked

  • The DS values at the registrar exactly match the values shown by Enhance.
  • A public DNSSEC checker reports a valid chain rather than a missing or bogus result.

What the controls do

Control What it means
DNSSEC switch Enables signing for the Enhance-hosted zone.
DS record The parent-zone record that trusts the signing key.
Key tag / digest Values that must match between Enhance and the registrar.