DNSSEC adds a digital signature to your domain’s DNS records, so internet providers can tell a genuine answer from a forged one. It’s free to use with most good DNS providers, and .com.au supports it. It’s worth turning on when your DNS host manages the keys for you, but it isn’t the first domain security step for most small businesses.
Key takeaways
- DNSSEC protects against forged DNS answers that could send visitors or email to a fake server.
- It doesn’t encrypt anything, and it doesn’t stop someone logging into your registrar account.
- The .au zone has been signed since 2014, so .com.au and .au domains can use it.
- The real cost is risk: a mistake with DNSSEC can make your whole domain unreachable.
- Lock down your registrar account first, then add DNSSEC if your DNS host automates it.
What does DNSSEC actually do?
Every time someone visits your website or sends you an email, their device asks the DNS where your domain lives. DNS is the internet’s address book, and our guide to DNS records explains the parts. Normally, nothing proves the answer is genuine.
DNSSEC fixes that. You sign your DNS records with a private key, and checking servers (called validating resolvers) confirm the signature with your public key. ICANN describes the result as two guarantees: the data really came from your domain, and it hasn’t been changed on the way (ICANN).
What attack does DNSSEC stop?
The main one is DNS spoofing, also called cache poisoning. An attacker slips a fake answer into an internet provider’s DNS server. That server then hands the fake address to everyone who asks, sending them to a copycat site that collects logins or payments. ICANN uses a fake bank site as its example.
With DNSSEC on, a validating resolver rejects the forged answer because its signature doesn’t match. Visitors get an error instead of a fake site, which is the safer failure.
How does the chain of trust work?
A signature only helps if the checker trusts the key. DNSSEC solves this with a chain: each level vouches for the one below it using a DS record. Your registrar sends your DS record to the registry, which links your domain to the chain.
auDA signed the .au zone on 20 November 2014 and added DS records for com.au, org.au and other second-level zones that December (auDA). So the Australian part of the chain is ready. Whether you can use it depends on your registrar accepting DS records for .au names.
What doesn’t DNSSEC protect?
This is where DNSSEC gets oversold. It doesn’t:
- Encrypt anything. DNS answers are still readable. ICANN’s page covers authentication and integrity, not privacy.
- Stop account takeovers. If someone logs in to your registrar account, they can change your records or DS record legitimately. Our guide to domain hijacking covers that bigger risk.
- Protect your website. A hacked WordPress site with valid DNSSEC is still hacked. That’s a job for website security monitoring.
- Work everywhere. It only helps visitors whose internet provider validates signatures. ICANN notes that validation and signing both have to be switched on.
What does DNSSEC cost, and what can go wrong?
The money cost is usually nil: many DNS hosts include it. The real cost is the risk of a mistake. If the DS record at your registrar doesn’t match your DNS host’s keys, validating resolvers return an error and your website and email stop resolving for many people. Cloudflare’s documentation warns of exactly this (Cloudflare).
The most common trigger is moving DNS hosts. Cloudflare advises removing the DS record first and waiting for it to expire before changing nameservers. In our experience, this is the step people forget during a host or registrar move.
Should a small business turn on DNSSEC?
Here’s our honest take. Turn it on if:
- your DNS host signs records and rotates keys automatically, and
- your registrar accepts DS records for your .au domain, and
- you take payments, logins or sensitive enquiries through the site.
Hold off if you manage DNS by hand, or a move between hosts is coming up. Either way, do the basics first: two-factor login and a registrar lock. Our domain security service covers those, and DNSSEC fits on top.
How do you check if your domain uses DNSSEC?
- Ask your DNS host. Look for a DNSSEC setting in the DNS zone screen.
- Check your registrar. The domain’s settings show any DS records.
- Use a free test. Online DNSSEC analysers show whether each link in the chain is valid.
Starting fresh? Run a domain name search first, then register your domain with WMS and ask us about the security settings.
Frequently asked questions
Is DNSSEC the same as SSL?
No. SSL (HTTPS) encrypts the connection between a visitor and your website and proves the site’s identity. DNSSEC proves that the DNS answer pointing to your server is genuine. They protect different steps and work well together.
Does DNSSEC slow down my website?
Not in any way visitors would notice. Signed answers are a little larger and resolvers do some extra checking, but answers are cached. Your hosting, images and plugins affect speed far more.
Can I use DNSSEC on a .com.au domain?
Yes. auDA signed the .au zone in 2014 and com.au soon after. You need a DNS host that signs your records and a registrar that can submit your DS record to the .au registry.
What happens if I move hosts with DNSSEC on?
If the old DS record stays in place while new nameservers take over, the signatures won’t match and your domain can stop resolving. Remove the DS record first, wait for it to expire, move, then set DNSSEC up again.
Does DNSSEC help SEO?
There’s no evidence it’s a ranking factor. Its value is protecting visitors from forged DNS answers. For search, focus on content, speed and a secure, well-maintained site.
Sources
- DNSSEC: What is it and why is it important?, ICANN
- Domain Name System Security Extensions (DNSSEC), auDA
- DNSSEC, Cloudflare Docs