How to: Enable DNSSEC

How to: Enable DNSSEC

When to use this guide

Use this guide when  internet.nl/site/  (listed in the  Domain & server security checklist⁠ ) shows either or both of:
  • Domain name not signed (DNSSEC): the DNS zone has no cryptographic signatures
  • DS record missing at registrar: the zone may be signed, but the chain of trust is incomplete
Both checks fail together when DNSSEC is not enabled at all, which is the most common situation.
How urgent is this? DNSSEC is a relatively low-risk gap compared to missing DMARC enforcement or MFA. It protects against a specific and sophisticated attack (DNS spoofing/cache poisoning) but does not affect HTTPS, email security, or day-to-day website security. It is required for the Dutch  internet.nl  standard and is a prerequisite for DANE (an advanced email security layer). Treat this as a "fix when the opportunity arises" issue: not worth migrating your DNS provider for if this is the only reason to do so.

Who does this?

The person holding the  Domains & DNS role  in your organisation.
This requires access to two places:
    The DNS hosting provider — to enable DNSSEC signing on the zone
    The domain registrar (where the domain was registered) — to publish the DS record
These may be the same party, or two different parties.

Background: what is DNSSEC?

Concept
What it does
DNSSEC zone signing
Adds cryptographic signatures to all DNS records, so resolvers can verify they haven't been tampered with
DS record at registrar
Published at the parent zone (e.g. SIDN for .nl), it completes the chain of trust from the root all the way down to your domain
Chain of trust
The full path from root → .nl →  yourdomain.nl  must be signed at every level for DNSSEC to work end-to-end
Without DNSSEC, visitors can in theory be silently redirected to malicious servers (DNS spoofing / cache poisoning) even if HTTPS is active. In practice this attack requires significant resources and is rare.


Step 1: Check whether your DNS provider supports DNSSEC

Not all DNS hosting providers support DNSSEC. Before proceeding, check the table below.
Check Mark Button Providers that support DNSSEC:
Provider
Notes
Cloudflare
Free, one-click enablement — recommended
TransIP
Dutch registrar, widely used for .nl
Versio
Dutch, supports DNSSEC
Antagonist
Dutch, supports DNSSEC
AWS Route 53
Supported
Google Cloud DNS
Supported
Azure DNS
Supported
GoDaddy
Via Premium DNS plan
Namecheap
Supported
ClouDNS
Supported
deSEC
Free, German non-profit, DNSSEC enabled by default
Cross Mark Providers that do NOT support DNSSEC:
Provider
Notes
SiteGround
DNSSEC not supported — confirmed in their documentation
Hetzner
DNSSEC not supported — confirmed in their documentation
If your DNS is hosted at SiteGround or Hetzner, you cannot enable DNSSEC without migrating your DNS zone to a different provider. Given the low urgency of DNSSEC (see above), this migration is only worth doing if you have other reasons to switch providers as well.


Step 2: Enable DNSSEC at your DNS hosting provider

Log in to the control panel of your DNS hosting provider and find the DNSSEC section. The exact location varies per provider — search their documentation for "DNSSEC" if you can't find it.
Enable zone signing. The provider will generate the zone keys and sign all DNS records automatically. Once enabled, the provider will show you a DS record containing four values:
  • Key Tag
  • Algorithm
  • Digest Type
  • Digest
Copy these — you need them for Step 3.


Step 3: Publish the DS record at your domain registrar

Log in to the registrar where the domain is registered (the party you pay for the domain name itself).
Find the DNSSEC or DS record settings for the domain and enter the four values from Step 2 (Key Tag, Algorithm, Digest Type, Digest).
For .nl domains, the registrar submits this to SIDN (the .nl registry), which completes the chain of trust.
Do not skip this step. Even if the zone is signed in Step 2, the chain of trust is broken without the DS record at the registrar — and  internet.nl  will still fail the test.


Step 4: Wait for propagation

DNS changes can take up to 48 hours to propagate globally, though for DNSSEC it is typically faster (under an hour for .nl domains once the DS record is submitted).


Step 5: Verification: re-run the test

Verify using  internet.nl/site/  — enter the domain and run a new test. Both subtests should now pass:
  • Check Mark Button DNSSEC is enabled on the domain's DNS zone
  • Check Mark Button DS record is present at the registrar
For a more detailed view of the chain of trust, use  DNSViz  — enter the domain and check the DNSSEC view. Every node in the chain should show green.