Knowledgebase

What is DNSSEC?

DNSSEC creates a secure domain name system by adding cryptographic signatures to existing DNS records. These digital signatures are stored in DNS name servers alongside common record types like A, AAAA, MX, CNAME, etc. By checking its associated signature, you can verify that a requested DNS record comes from its authoritative name server and wasn’t altered en-route, opposed to a fake record injected in a man-in-the-middle attack.

To facilitate signature validation, DNSSEC adds a few new DNS record types:

RRSIG - Contains a cryptographic signature

DNSKEY - Contains a public signing key

DS - Contains the hash of a DNSKEY record

NSEC and NSEC3 - For explicit denial-of-existence of a DNS record

CDNSKEY and CDS - For a child zone requesting updates to DS record(s) in the parent zone.

Example of a DS record:

Adding a DNSSEC (DS) Record to Your Domain

If your nameserver provider has given you a DS record and you'd like us to add it to your domain, there are two requirements to be aware of:

1. We need to be your domain registrar. This is required so we're able to submit the DS record to the registry on your behalf.
2. You'll need to be using external nameservers with a provider that supports DNSSEC, as this is where the DS record is generated from.

If both of these apply to you, simply send us the DS record details and we'll submit them to the registry to complete the setup. You can raise a support ticket from within your account here - https://chi.westhost.com/support