DNSSEC protects your domain against forged DNS answers. We sign your zone with a key. A DS record at the registry (the organisation that runs your domain's ending, such as .eu) tells resolvers which key to trust. Resolvers that check DNSSEC then refuse any answer that does not match the signature.
It works in two steps:
- Signing happens on our side. On its own it changes nothing for your visitors.
- Publishing the DS at the registry switches validation on. From then on, every record has to be served correctly and signed.
Once your zone is signed, we re-sign it automatically every time you change a record. There is nothing to maintain.
Before you start
- Your domain's DNS must be hosted here: the domain has a DNS records tab under Domains.
- Turning DNSSEC on or off takes the Owner, Administrator or Developer role. Other roles see the state, but not the buttons.
- Check that your domain resolves correctly from our nameservers. The Nameservers state at the top of the domain's page should read veldhost.
Caution: Once the DS is published, the domain stops resolving for validating resolvers if the zone is ever served unsigned or by someone else. Before you move your DNS away from veldhost later, remove the DS first. See If DNSSEC is on.
See the current state
Open Domains → your domain. The DNSSEC tile at the top of the DNS records tab shows one of three states:
- Off: the zone is not signed.
- Signed, no DS: we sign the zone, but no DS is published yet, so validation is not on.
- Active: signed, and the DS is at the registry.
Select the tile to go to the DNSSEC section on the Overview tab, where you turn it on.
Domain registered elsewhere
- In the DNSSEC section, choose Enable DNSSEC. We sign the zone. Your visitors see no change.
- The section now says DNSSEC is signed — one step left and shows what to enter at your registrar. Registrars ask for one of two sets of fields, and both describe the same key:
- If the form asks for a digest (often called a DS record): key tag, algorithm, digest type and digest.
- If the form asks for a public key (often called a DNSKEY or key data): key type (flags), protocol, algorithm and public key.
- If the form is a single text box, open The form is a single text box, or you edit a zone file for the whole DS record on one line.
- Enter it in your registrar's DNSSEC settings.
Registries take from a few minutes to an hour to publish it. The page checks each time it loads. When the DS is found and matches our key, the section says DNSSEC is active.
If the section says The DS record at your registrar does not match, a DS for a different key is published, perhaps from your previous DNS provider or from a typing error. Validating resolvers refuse the domain until it is fixed. Replace it at your registrar with the record shown.
To turn DNSSEC off for a domain registered elsewhere, delete the DS record at your registrar. There is no switch for it here.
Domain registered with us
We are the registrar, so there is nothing to copy.
In the DNSSEC section, choose Enable DNSSEC. We sign the zone and publish the DS at the registry in one step. You see DNSSEC is now active. Validating resolvers can take up to an hour to pick it up.
We only publish while the registry delegates the domain to our nameservers alone and public resolvers agree. Mid-change, or pointed partly elsewhere, the page says so and nothing changes.
If the section says DNSSEC mismatch or Stale DS, the DS at the registry does not match the key we sign with, or we do not sign the zone at all. What you see depends on whose DS it is:
- Every DS there is ours (from our current key or an earlier one): choose Fix DNSSEC. We read the registry again, then put the DS for our current key there if only our nameservers serve the domain, or remove our old DS if they do not. You see Fixed and what we did.
- One of them is not ours, usually your new DNS provider's during a move: the section says so and changes nothing, because if that DS is the right one, replacing it would take the domain offline. Moving to that provider? Change the nameservers to theirs, then use Prepare to move away, which removes our DS and keeps theirs. Staying with us and you don't recognise it? Contact support.
If signing works but the registry does not accept the DS straight away, the page says so. Nothing changes at the registry, and your domain keeps working. Try again in a moment.
To turn it off, choose Turn DNSSEC off, then confirm. This removes our DS at the registry. Your zone stays signed, so you can turn it on again later. If the registry does not remove the DS, the page says DNSSEC is still on, and nothing has changed.
With an AI assistant or the API
Ask an assistant to check first. get_domain_registrar reports the real DNSSEC state at the registry. probe_domain_dns checks that every nameserver answers the same.
enable_dnssec (and the API) works for any domain whose zone we host:
- Registered elsewhere: it signs the zone and returns the DS record, with the public key fields, for you to add at your registrar, just like Enable DNSSEC in the portal. Nothing is published anywhere, so it acts on the first call.
- Registered with us: it signs the zone and publishes the DS at the registry. The tool is two-step: the first call changes nothing and returns a warning. The assistant must show you that warning and call again only after you agree.
If we do not host the zone of a domain registered with us, they say so: have your DNS provider sign it and add the DS record it gives you on the domain's page (My DNS provider gave me a DS record). They also refuse when the registry already holds a DS that is not ours (see above), and when the domain is not served by our nameservers alone, or its nameservers are still changing: a DS for a zone other servers answer for would take it offline.
From a script, POST /api/v1/domains/{domain}/dnssec needs the dns scope. See Errors, rate limits and idempotency for how the two steps work.