Enable DNSSEC

The domain name system (DNS) translates domain names into numeric Internet addresses. However, DNS is a fundamentally insecure protocol. It does not guarantee where DNS records come from and accepts any requests given to it.

DNSSEC creates a secure layer to the domain name system by adding cryptographic signatures to DNS records. By doing so, your request can check the signature to verify that the record you need comes from the authoritative nameserver and was not altered along the way.

Cloudflare Registrar offers one-click DNSSEC activation for free to all customers:

1. In Cloudflare dashboard, go to the Manage Domains page.

   Go to Manage domains ↗

2. Find the domain that you want to activate DNSSEC and select Manage.

3. Select Configuration > Enable DNSSEC. If DNSSEC was previously activated, select Disable DNSSEC to disable it.

Cloudflare publishes delegation signer (DS) records in the form of CDS and CDNSKEY records for a domain delegated to Cloudflare. Cloudflare Registrar scans those records at regular intervals, gathers those details and sends them to your domain's registry.

This process can take one to two days after you first enable DNSSEC.

When DNSSEC has been successfully applied to your domain, Cloudflare shows you a confirmed status. Go to DNS > Settings in the Cloudflare dashboard, and scroll down to DNSSEC.

You can also confirm this by reviewing the WHOIS information for your domain. Domains with DNSSEC will read signedDelegation in the DNSSEC field.