What DNSSEC is and how to set it up in cPanel

DNSSEC lets compatible resolvers verify that a DNS answer comes from the signed zone and hasn't been tampered with. It doesn't encrypt queries, doesn't replace HTTPS and doesn't guarantee that a website's content is safe.

Enabling it takes two parts: signing the zone at the DNS provider and publishing the trust link at the registrar. The browser doesn't carry out all of that validation on its own.

Check where the DNS is managed

This guide applies when the domain uses the hosting's nameservers. If it uses Cloudflare, follow the Cloudflare DNSSEC setup.

cPanel must have DNSSEC management enabled and use a compatible DNS service, such as PowerDNS. If the option doesn't appear, contact support. Don't generate values from another domain's or server's keys.

Generate the key in cPanel

1. Open Zone Editor and find the right domain.
2. Go to DNSSEC and click Create Key.
3. Use an algorithm your registrar and extension support. If you don't need a specific configuration, review the suggested options before creating the key.
4. Open the generated key's details and keep its type, algorithm and public key.

Complete the activation at the registrar

If the domain is registered with Hostsuar, add the key from the client area. Our form asks for the KSK public key and the algorithm; don't paste the full text of the DS record into the public key field.

Other registrars ask for the DS fields directly: key tag, algorithm, digest type and digest. Follow the format that applies, without mixing a DS digest with a DNSKEY key.

cPanel showing a key isn't enough: check that the zone is being signed and that the link published at the registrar matches it.

Check the chain of trust

Use a DNSSEC validator and check both the domain and its delegation. Saving the configuration doesn't guarantee that resolvers have stopped using old information. If SERVFAIL appears after enabling DNSSEC, keep the diagnosis and ask for help before regenerating or deleting keys.

Disable DNSSEC or change provider

First remove the DS record or the keys published through the registrar. Wait for the TTL of that information in the parent zone to expire, and only then stop signing or delete the keys at the DNS provider. Doing it the other way round can stop the domain from resolving on servers that validate DNSSEC.

For a move, plan the DNS change with minimal downtime before changing the delegation.