On this page

Fixing DNSSEC in Cloudflare

What this fixes

DNSSEC signs your DNS records so resolvers can verify they haven't been tampered with, protecting against DNS spoofing. See Enabling DNSSEC for Your Domain for what it does and why it matters — this guide covers the Cloudflare-specific steps.

You'll need your domain added to Cloudflare as a zone, with Cloudflare set as (or delegated) your authoritative DNS.

How to fix it

  1. Go to DNS → Settings (or DNSSEC in the sidebar, depending on your dashboard version).
  2. Click Enable DNSSEC.
  3. Cloudflare generates a DS record for you.
  4. Copy the DS record and add it at your domain registrar — this happens outside Cloudflare, at whichever company you registered the domain name through. Skip this step if your domain is also registered through Cloudflare Registrar, or is a .ch/.cz domain — those get the DS record added automatically.
  5. Wait for propagation (can take up to 24 hours), then confirm the status shows Active in Cloudflare's DNSSEC settings.
  6. Re-run your scan to confirm.

Common pitfalls

  • Forgetting the DS record step at your registrar — DNSSEC won't validate until that's done, and it's easy to think you're finished once Cloudflare shows the record generated.
  • Not waiting long enough for propagation before re-scanning — give it a few hours.