DNSSEC: worth turning on?
DNSSEC stops forged DNS answers for your domain. With most DNS providers it’s now one switch. Here’s when it matters.
DNSSEC adds signatures to your DNS records, so resolvers can check that an answer for your domain really came from your DNS provider and wasn’t forged on the way. It doesn’t encrypt anything. It just makes lying about your domain much harder.
For years it was fiddly. Now most DNS providers, Cloudflare included, enable it with one click, and you add one DS record at your registrar.
When it’s worth it:
- Domains used for email, login pages and payments.
- Government, banking and health organisations, where it’s often required.
- When your DNS provider and registrar both support it well.
Two cautions. If you move DNS providers, disable DNSSEC first or migrate the keys properly, otherwise the domain stops resolving. And DNSSEC doesn’t protect the account that controls your DNS. MFA and registrar lock still matter more.