On this page

Enabling DNSSEC for Your Domain

What it does

DNSSEC (Domain Name System Security Extensions) digitally signs your DNS records so that resolvers can verify they haven't been tampered with in transit — protecting against DNS spoofing and email hijacking (where attackers redirect your mail to a rogue server).

This is a setting you can typically enable yourself through your registrar or DNS host, though it requires a bit more coordination than a simple TXT record.

How to fix it

  1. Check whether your domain registrar and DNS host both support DNSSEC (most major ones do — Cloudflare, Route 53, Google Domains, GoDaddy, etc.).
  2. If your DNS is hosted with the same provider as your registrar, enabling DNSSEC is usually a single toggle in their dashboard (often labeled "DNSSEC" under DNS or domain settings).
  3. If your registrar and DNS host are different companies, you'll need to:
    • Enable DNSSEC signing at your DNS host — this generates a DS record.
    • Submit that DS record to your domain registrar, which publishes it to the parent zone.
  4. Allow some time (up to 24-48 hours) for DNSSEC to propagate, then re-run a scan to confirm it validates correctly.

Important note

Email hygiene scans often evaluate two domains for DNSSEC — your own domain, and the domain of your mail server (e.g. a hosted email provider's infrastructure domain, like protection.outlook.com for Microsoft 365). You can only fix DNSSEC for your own domain.

If the mail server's own domain shows as unsigned, that's a limitation of your email provider's infrastructure and isn't something you can change through your own DNS — enabling DNSSEC on your own domain is still worth doing, but it won't resolve that specific part of the check.

Common pitfalls

  • Enabling DNSSEC signing at the DNS host but forgetting to submit the DS record to the registrar — DNSSEC isn't fully active until both steps are done.
  • Making unrelated DNS changes right after enabling DNSSEC without re-signing the zone, which can cause validation failures.
  • Assuming a "fail" on this check means your own domain is misconfigured, when it may actually be the mail server's domain (outside your control) — check which part of the result is failing before troubleshooting.