Turn on DNSSEC on Cloudflare

Why it matters

DNSSEC lets resolvers check that DNS answers for your domain were not forged. Without it, an attacker who tampers with DNS responses could send visitors to a fake site.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Open DNS then Settings and choose Enable DNSSEC. Cloudflare creates the keys and shows the DS record values.
2. Cloudflare adds the DS record for you only at Cloudflare Registrar and for .ch and .cz domains, which can take one to two days. At any other registrar, add it in that registrar's DNSSEC settings yourself. Cloudflare signs with algorithm 13 (ECDSA P-256).
3. Cloudflare shows the status as active when the DS record is in place.
4. To turn it off again, remove the DS record at the registrar first and wait for its TTL before disabling DNSSEC in Cloudflare.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Make your DNSSEC signatures something resolvers can validate
• Publish the DS record at your registrar
• Find out why resolvers disagree about your DNSSEC
• Move DNSSEC to a stronger signing algorithm
• Add a SHA-256 DS record