# DNSSEC > Sign your zone so resolvers can tell real answers from forged ones, and finish it with a DS record at the registry. Source: https://veldhost.eu/docs/dnssec Last verified: 2026-11-13 DNSSEC protects your domain against forged DNS answers. We sign your zone with a key. A **DS record** at the registry (the organisation that runs your domain's ending, such as `.eu`) tells resolvers which key to trust. Resolvers that check DNSSEC then refuse any answer that does not match the signature. It works in two steps: 1. **Signing** happens on our side. On its own it changes nothing for your visitors. 2. **Publishing the DS** at the registry switches validation on. From then on, every record has to be served correctly and signed. Once your zone is signed, we re-sign it automatically every time you change a record. There is nothing to maintain. ## Before you start - Your domain's DNS must be hosted here: the domain has a **DNS records** tab under [Domains](https://manage.veldhost.eu/portal/domains). - Turning DNSSEC on or off takes the **Owner**, **Administrator** or **Developer** role. Other roles see the state, but not the buttons. - Check that your domain resolves correctly from our nameservers. The **Nameservers** state at the top of the domain's page should read **veldhost**. > **Caution:** Once the DS is published, the domain stops resolving for validating resolvers if the zone is ever served unsigned or by someone else. Before you move your DNS away from veldhost later, remove the DS first. See [If DNSSEC is on](https://veldhost.eu/docs/nameservers#if-dnssec-is-on). ## See the current state Open [Domains](https://manage.veldhost.eu/portal/domains) → your domain. The **DNSSEC** tile at the top of the **DNS records** tab shows one of three states: - **Off**: the zone is not signed. - **Signed, no DS**: we sign the zone, but no DS is published yet, so validation is not on. - **Active**: signed, and the DS is at the registry. Select the tile to go to the **DNSSEC** section on the **Overview** tab, where you turn it on. ## Domain registered elsewhere 1. In the **DNSSEC** section, choose **Enable DNSSEC**. We sign the zone. Your visitors see no change. 2. The section now says **DNSSEC is signed — one step left** and shows what to enter at your registrar. Registrars ask for **one** of two sets of fields, and both describe the same key: - **If the form asks for a digest** (often called a DS record): key tag, algorithm, digest type and digest. - **If the form asks for a public key** (often called a DNSKEY or key data): key type (flags), protocol, algorithm and public key. - If the form is a single text box, open **The form is a single text box, or you edit a zone file** for the whole DS record on one line. 3. Enter it in your registrar's DNSSEC settings. Registries take from a few minutes to an hour to publish it. The page checks each time it loads. When the DS is found and matches our key, the section says **DNSSEC is active**. If the section says **The DS record at your registrar does not match**, a DS for a different key is published, perhaps from your previous DNS provider or from a typing error. Validating resolvers refuse the domain until it is fixed. Replace it at your registrar with the record shown. To turn DNSSEC off for a domain registered elsewhere, delete the DS record at your registrar. There is no switch for it here. ## Domain registered with us We are the registrar, so there is nothing to copy. In the **DNSSEC** section, choose **Enable DNSSEC**. We sign the zone and publish the DS at the registry in one step. You see **DNSSEC is now active**. Validating resolvers can take up to an hour to pick it up. We only publish while the registry delegates the domain to our nameservers alone and public resolvers agree. Mid-change, or pointed partly elsewhere, the page says so and nothing changes. If the section says **DNSSEC mismatch** or **Stale DS**, the DS at the registry does not match the key we sign with, or we do not sign the zone at all. What you see depends on whose DS it is: - **Every DS there is ours** (from our current key or an earlier one): choose **Fix DNSSEC**. We read the registry again, then put the DS for our current key there if only our nameservers serve the domain, or remove our old DS if they do not. You see **Fixed** and what we did. - **One of them is not ours**, usually your new DNS provider's during a move: the section says so and changes nothing, because if that DS is the right one, replacing it would take the domain offline. Moving to that provider? Change the nameservers to theirs, then use **Prepare to move away**, which removes our DS and keeps theirs. Staying with us and you don't recognise it? Contact support. If signing works but the registry does not accept the DS straight away, the page says so. Nothing changes at the registry, and your domain keeps working. Try again in a moment. To turn it off, choose **Turn DNSSEC off**, then confirm. This removes our DS at the registry. Your zone stays signed, so you can turn it on again later. If the registry does not remove the DS, the page says DNSSEC is still on, and nothing has changed. ## With an AI assistant or the API Ask an assistant to check first. `get_domain_registrar` reports the real DNSSEC state at the registry. `probe_domain_dns` checks that every nameserver answers the same. `enable_dnssec` (and the API) works for any domain whose zone we host: - **Registered elsewhere:** it signs the zone and returns the DS record, with the public key fields, for you to add at your registrar, just like **Enable DNSSEC** in the portal. Nothing is published anywhere, so it acts on the first call. - **Registered with us:** it signs the zone and publishes the DS at the registry. The tool is two-step: the first call changes nothing and returns a warning. The assistant must show you that warning and call again only after you agree. If we do not host the zone of a domain registered with us, they say so: have your DNS provider sign it and add the DS record it gives you on the domain's page (**My DNS provider gave me a DS record**). They also refuse when the registry already holds a DS that is not ours (see above), and when the domain is not served by our nameservers alone, or its nameservers are still changing: a DS for a zone other servers answer for would take it offline. From a script, `POST /api/v1/domains/{domain}/dnssec` needs the `dns` scope. See [Errors, rate limits and idempotency](https://veldhost.eu/docs/api-errors-and-limits#actions-that-ask-twice) for how the two steps work. ## Related - [Change a domain's nameservers](https://veldhost.eu/docs/nameservers) - [Domain dark after DNSSEC or a nameserver change](https://veldhost.eu/docs/dnssec-broke-my-domain) - [Edit DNS records](https://veldhost.eu/docs/dns-record-editor) - [Move your DNS to veldhost](https://veldhost.eu/docs/move-your-dns-to-veldhost)