Querying every nameserver directly — this takes a few seconds.
Querying every nameserver directly — this takes a few seconds.
delegation.dnssec
DNSSEC lets resolvers verify that an answer really came from the zone owner rather than an attacker on the path.
DNSSEC signs DNS answers so that a resolver can verify they came from the zone owner rather than from somebody on the network path. The chain runs downward: the parent zone publishes a DS record that commits to your zone's key, your zone publishes the key and signatures over its records, and a validating resolver checks each link back to the root.
Whether to sign is a real decision rather than an obvious yes. Signed and correct is better than unsigned. **Signed and broken is far worse than unsigned**, because a validating resolver treats a failed signature as an attack and returns SERVFAIL rather than the record — the domain does not degrade, it disappears, for the substantial fraction of the internet behind validating resolvers.
Almost all real DNSSEC outages are key management: a key rolled in the zone without the DS being updated at the registrar, signatures allowed to expire, or a DNS provider migration done without unsigning first.
If you are turning it on, use a provider that manages signing and key rollover for you and that can push DS updates to the registry automatically. Hand-managed DNSSEC is a standing commitment to a task that fails loudly at a time of its own choosing.
If you are moving DNS providers on a signed domain, unsign first: remove the DS at the registrar, wait for its TTL to expire everywhere, then migrate, then re-sign. Transferring a signed zone between providers without that step is one of the more reliable ways to take a domain off the internet.
Monitor expiry. RRSIG records have a validity window, and a signer that stops running takes the domain down when the last signature expires rather than at the moment it fails.
DNSSEC is one of 49 checks in every report, alongside delegation, mail authentication, TLS and registration.