Exabytes Group

DNSSEC adds an authentication layer to an otherwise insecure DNS infrastructure. It guarantees that visitors are directed to your web server when they type your domain into a web browser, thus avoiding man-in-the-middle attacks and other types of DNS forgeries.

For more in-depth information, see the Learn more about DNSSEC section at the end of this article.

When you enable DNSSEC, Cloudflare:

• Signs your zone
• Publishes your public signing keys
• Generates your DS record

Note that not all registrars and top-level domains (TLD) support DNSSEC. 

Enabling DNSSEC for your domain requires enabling DNSSEC in Cloudflare and adding a special record to your DNS configuration at the registar.

Cloudflare supports setting up DNSSEC automatically (via CDS and CDNSKEY record types) without requiring customers to manually upload a DS record for domains registered under these top-level domains:

• .ch
• .cz

Below are the two steps required for adding DNSSEC support to your Cloudflare proxied domain.

Step 1 - Enable DNSSEC in Cloudflare DNS

By enabling DNSSEC first in the Cloudflare dashboard, you’re asking Cloudflare to generate the data necessary for adding a delegation signer (DS) record to your domain at the registrar.

CloudFlare's chosen cipher suite (Algorithm 13, also known as ECDSA Curve P-256 with SHA-256), is not supported by some registrars. Note that some registrars support a different set of verification algorithms depending on the TLD. 

To obtain the Cloudflare DS record data:

1. Log in to the Cloudflare dashboard.

2. Ensure the website for the DS record you need is selected.

3. Click the DNS app.

4. Scroll down to the DNSSEC panel.

5. Click Enable DNSSEC. You will see a dialog informing you that your configuration is pending until the DS record is added at your registrar.

6. Next, click to expand the DS Record dropdown in the DNSSEC panel.

7. Copy the DS record information displayed as you will need it for Step 2 below.

Step 2 - Add a DS record to your registrar

After completing Step 1 above, you should have the Cloudflare-generated DS data handy to complete this step.

To complete your DNSSEC configuration, it is necessary for your domain to have a DS record in your domain DNS configuration at the registrar. Find your registrar below and follow the instructions provided.

What if my registrar or TLD doesn't support DNSSEC?

To enable DNSSEC, both your registrar and registry (TLD) need to support DNSSEC with Cloudflare's preferred cipher choice, Algorithm 13.

Although DNSSEC support is required by ICANN and Algorithm 13 has been standardized for years, some registrars and registries do not support these protocols yet.

To try to get your registrar to support DNSSEC, you have three options:

1. Contact your registrar to ask for DNSSEC with modern encryption. Many registrars are waiting to add support until they see higher demand, so by reaching out, you are letting them know that there is a need for DNSSEC with Algorithm 13.

2. You can transfer your domain to a different registrar that supports DNSSEC with Algorithm 13, as listed in Step 2 above.

3. Finally, you can file a complaint with ICANN, citing your registrar's lack of compliance. ICANN requiresregistrars to support DNSSEC with all available DS algorithm types.

If support is lacking at the TLD level, try option 1 above. You can find the contact information for your TLD registry in the Iana Root Zone Database.

Learn more about DNSSEC

• Cloudflare DNSSEC
• Troubleshooting DNSSEC
• Blog - Announcing Universal DNSSEC: Secure DNS for Every Domain
• Blog - Introduction to DNSSEC
• About Algorithm 13 support - ECDSA: The missing piece of DNSSEC
• List of TLDs with no DNSSEC support