Turn on DNSSEC (and what to do when it breaks)

DNSSEC adds a layer of trust to your domain's DNS answers, protecting visitors from forged results. This article is for anyone who manages DNS in InfraNest and wants to turn DNSSEC on safely — or fix it if something breaks.

Overview

• DNSSEC signs your DNS answers so they can't be faked on the way to a visitor.
• It is worth setting up, but it is also the one DNS setting that can take your domain offline if it's done wrong.
• It depends on two separate places agreeing with each other — your DNS provider and your registrar — which is where most problems come from.

Understand the two places DNSSEC lives

This is the part that catches almost everyone, so it's worth reading before you turn anything on.

1. Your DNS provider signs the zone — it generates a key and signs every answer it gives out.
2. Your registrar publishes a short fingerprint of that key (called a DS record) in the zone above yours, at the registry that runs your domain ending.

Neither half does anything by itself. Signing without the fingerprint published means nobody checks the signatures. Publishing the fingerprint without signing means every check fails.

NoteThe DS record does not go in your own DNS zone — it's the only DNS record you can't publish yourself. Only the registry above you can hold it, which is why it goes through your registrar. Adding it to your own zone does nothing.

This is also why DNSSEC appears on the domain page next to the nameservers, rather than in the record editor.

Turn on DNSSEC

1. Go to DNS and open the zone you want to protect.
2. Choose Set up DNSSEC — you'll find it in the Actions menu, and also in Protection where the advisor lists improvements.
3. InfraNest asks your DNS provider to sign the zone, then hands the fingerprint to your registrar automatically where it can.
4. Check the result:
   • Ready — nothing more to do; the rest of the internet catches up within a few hours.
   • If InfraNest can't publish the fingerprint at your registrar, copy the line shown and paste it into your registrar's own control panel.
   • If your provider doesn't hand out the key through InfraNest, collect the fingerprint from your provider's panel and add it at your registrar yourself.
   • If your provider is still starting to sign, do nothing — InfraNest checks again every twenty minutes and finishes publishing once it's ready.

If Set up DNSSEC isn't offered at all, your DNS provider has no way to switch signing on automatically (Hetzner and DigitalOcean are two examples). You can still do it by hand: turn on signing at your DNS provider, then open the domain in InfraNest, choose Manage DNSSEC, and enter what your provider gave you.

Turn off DNSSEC

1. Open the domain and press Turn off DNSSEC once.
2. This removes the fingerprint at your registrar first and deliberately leaves the zone signed a little longer — that is the safe order. Doing both at once can leave a fingerprint pointing at a key that no longer signs anything, which is what takes a domain offline.
3. You don't need to do anything else. InfraNest finishes the rest by itself, about a day later, once the old fingerprint has expired everywhere.

Fix DNSSEC when it breaks

A broken DNSSEC setup doesn't make your site look wrong — it makes your domain disappear. Anyone whose resolver checks DNSSEC gets no answer at all: no website, no email, no warning page. It usually happens when a key is rotated at the DNS provider without the fingerprint being updated, or after moving a domain between providers.

InfraNest checks every domain for this and alerts you as soon as it starts, because nothing in your own systems will show this failing.

If you get that alert:

1. Check the DS record at your registrar against the key your DNS provider is currently signing with — a mismatch is the usual cause.
2. If you can't fix it quickly, remove the DS record at the registrar. That switches DNSSEC off and brings the domain back for everyone, almost immediately. It's better to be unsigned than invisible.
3. Fix the mismatch, then put the DS record back.

Enter a key by hand

Where InfraNest can't publish the fingerprint for you, use Manage DNSSEC on the domain page:

1. Take the line your DNS provider gave you.
2. Paste the whole line into the box at the top, rather than filling in the fields one at a time. It reads either a DS line or a key line, with or without the surrounding zone details.
3. Check what InfraNest understood before you save — if it can't read the line, it will say so rather than guessing. A misread line publishes the wrong fingerprint, which is worse than publishing none.

Tips

TipDon't add DNSKEY or DS as record types yourself in the record editor. A DNSKEY is generated by your DNS provider when it signs the zone — you never type one. A DS belongs in the zone above yours, at the registry, so one added to your own zone does nothing. Use Set up DNSSEC next to your nameservers instead, unless you're specifically delegating a subdomain someone else has already signed.

Troubleshooting: what the labels mean

On the DNS zone page, next to the nameservers:

• DNSSEC on — signed, and resolvers are validating it. Nothing to do.
• DNSSEC off — not signed. This is a choice, not a fault.
• DNSSEC failing — signed, but validation fails, so the domain doesn't resolve for most people. Act now.

A label with an asterisk is based on the records InfraNest holds rather than a live check, so it can be briefly out of step with what the internet actually sees.