The short answer: DNSSEC is a digital signature on DNS answers. It lets whoever asks “where is this domain?” confirm the answer was not forged on the way. It encrypts nothing and does not protect the site or the e-mail: it protects only the question about the address. It is optional, and done wrong it makes the domain unreachable.
Today DNSSEC is not switched on for MozOut’s own domains: we measured, and none has the keys or the record at the domain registry. If you need it on yours, ask us first: it is not automatic, and this page explains why.
How it works, without extra jargon
| 1 |
The domain’s zone is signed with a key. The public key sits in the zone itself, in a record called DNSKEY.
|
|
| 2 |
The “fingerprint” of that key (the DS record) is handed to the level above, the extension’s registry, through the domain’s registrar.
|
|
| 3 |
Whoever asks checks the chain: the DS up there must match the key down here. If it matches, the answer is trusted. If it does not, the asker’s server refuses it, and the domain vanishes for that person.
|
|
How to see whether a domain has it
Ask for the two records: dig DNSKEY your-domain +short and dig DS your-domain +short. If both answer, it is signed. If neither answers, it is not, which is normal for the vast majority of domains. Both commands use dig, which installs on Linux and Mac.
| Your situation |
What to think |
| The domain of a blog, a shop or a small business |
Usually not needed. The gain is small and the risk of a mistake is real. |
| A bank, a public service or something that requires DNSSEC by rule |
Worth it, done carefully and with someone who knows how. |
| You already have DNSSEC at another provider and want to change nameservers |
Stop. Remove the DS record before you switch, or both sides must sign with the same keys. See Changing registrar without the site or e-mail blinking. |
|
The classic mistake: changing nameservers with an old DS still at the registry. Servers that validate DNSSEC start failing for everyone who uses them, and the domain “disappears” for those people until the DS is fixed. It is one of the hardest DNS problems to see, because for you it may keep opening.
|
|
Need DNSSEC on a domain that is with us? Open a ticket with the domain and tell us why.
Open a support ticket
|
RECOMMENDED PRODUCT Register your .com domain Secure your company name before someone else registers it. from $17.00/yr Search a domain |
Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
