What is DNSSEC — and should you actually turn it on?

Published September 18, 2026 · about a 6-minute read

A security scan flags "no DNSSEC," and now you're staring at an acronym wondering whether it's a real problem or just another box someone wants you to tick. Honest answer: it's a genuine security feature, most domains skip it on purpose, and the reason they skip it is more interesting than the feature itself. Let me save you the rabbit hole.

What DNSSEC actually does

When someone types your domain, their computer asks a DNS resolver "what's the IP for this?" Plain DNS has no way to prove the answer is real. An attacker who can slip a forged reply into that conversation — cache poisoning, spoofing — can send your visitors to a server they control, and the browser is none the wiser.

DNSSEC closes that gap. It adds cryptographic signatures to your DNS records, so a validating resolver can check that the answer genuinely came from you and wasn't altered in transit. Think of it as a tamper-evident seal on your DNS answers.

One thing it does not do: encrypt anything. DNSSEC proves authenticity, not privacy — anyone watching can still see what you looked up. Hiding the query itself is a different technology (DNS over HTTPS or TLS). People conflate the two constantly; don't.

Why most domains skip it

Here's the part the scan won't tell you: adoption is low, and not because everyone's lazy. Only about 4-5% of .com and .net domains are signed. Plenty of serious operations look at DNSSEC and decide against it. To understand why, you have to know the one real risk.

With DNSSEC, the thing most likely to hurt you isn't an attacker. It's a bad signature — and a bad signature doesn't weaken your domain, it deletes it.

When DNS signing goes wrong — a key rotation botched, a signature left to expire, a DS record that doesn't match — validating resolvers don't fall back to "well, serve it anyway." They return SERVFAIL. Your domain simply stops resolving for a chunk of the internet, and it looks exactly like an outage, because it is one. Plain DNS fails open; DNSSEC fails closed. That's the whole tradeoff in one sentence.

So should you enable it?

My rule of thumb, having watched both the attacks it prevents and the outages it causes:

• If your DNS host offers one-click DNSSEC with automatic key rotation (Cloudflare, Porkbun, and a growing list do), turn it on. The provider manages the keys and re-signs on schedule, so the outage risk that scares everyone off is handled for you. Low effort, low downside — go ahead.
• If enabling it means manually managing keys and DS records on a busy production zone, be honest about whether you'll keep up with rotation. If the tooling isn't fully automated, the downtime risk can outweigh the benefit — especially since TLS already protects the connection once the visitor reaches you. Plan it, don't blindly flip it.

"No DNSSEC" is a weaker finding than, say, a missing security header or an expired certificate. Treat it as "worth doing if it's cheap for your setup," not "drop everything."

How to turn it on

The modern path, if your registrar and DNS host are the same (or both support CDS/CDNSKEY automation):

1. Find the DNSSEC toggle in your DNS dashboard and enable it.
2. That's often it — the provider signs the zone and publishes the DS record to the registry for you, then rotates keys automatically.

The manual path, if your DNS provider and registrar are different:

1. Enable signing at your DNS provider; it generates a DS record.
2. Copy that DS record into your registrar's control panel.
3. Wait for it to propagate, then verify it validates before you walk away.

Whatever you do, confirm automatic key rotation is on. Manual key rotation is the single most common way DNSSEC domains take themselves offline.

The reason to keep an eye on it

DNSSEC's failure mode is silent right up until it isn't. A signature quietly expires, and the first you hear of it is customers saying the site "won't load" while it loads fine for you (your resolver may have it cached). That's the same pattern I keep flagging with certificate expiry — a dated, unattended thing that lapses without warning. If you sign your zone, something outside your infrastructure should be checking that it still validates, every day.

You can see where your domain stands right now — our free site checker reports your DNS posture (DNSSEC, CAA, SPF/DMARC) alongside your TLS and headers, no signup. If you also handle email, the DMARC guide and SPF/DKIM/DMARC walkthrough cover the records that matter more day-to-day than DNSSEC does.