What is DNSSEC?
DNSSEC protects visitors against forged DNS answers. How it works and how to check it.
When someone visits your website, their computer first looks up the IP address via DNS. Without DNSSEC, an attacker could forge that answer and quietly send visitors to another server.
DNSSEC adds a digital signature to your domain's DNS data. The visitor's resolver verifies that signature, so a forged answer is detected immediately.
How does it work?
- The DNS server signs your domain's records with a private key.
- A fingerprint of the public key (the DS record) is stored at the registry, for example SIDN for .nl.
- Resolvers, such as your internet provider's, verify every signature through that chain.
DNSSEC at Knippin
- DNS at Knippin (DirectAdmin or Hetzner): want DNSSEC? Create a ticket. We check whether it is possible for your domain and DNS location. If so, we take care of signing and passing the key to the registry.
- DNS with another provider (own nameservers): that provider signs the zone. Send us the DS record or DNSKEY in a ticket and we will submit it to the registry.
Moving to other nameservers? Then DNSSEC must be switched off first, or the new key must be submitted at the same time. Otherwise your domain becomes unreachable for anyone who validates DNSSEC. Let us guide this for you.
Checking
You can check DNSSEC with free tools:
- internet.nl: tests website and email, including DNSSEC;
- dnsviz.net: shows the whole chain of signatures;
- zonemaster.net: an extensive check of your DNS.