DNSSEC (Domain Name System Security Extensions) adds an extra layer of security to your domain by signing your DNS records.
DNSSEC cannot be enabled, disabled, or modified directly inside your account dashboard. However, you can easily verify whether your domain is signed using official registry WHOIS tools or global lookup services.
How to Check Your DNSSEC Status
Depending on your domain extension (TLD), you can verify your DNSSEC status using the official registry tools below:
1. For .CA Domains (CIRA)
- Visit the official CIRA WHOIS Lookup.
- Enter your
.CAdomain name and click Search. - Scroll down to the Domain Information section (just below the Update Date field).
-
Look for the Signed field:
Signed– DNSSEC is active and published at the registry.
2. For .COM & .NET Domains (Verisign)
- Visit the official Verisign Web WHOIS Lookup.
- Enter your domain name and click Search.
-
Scroll down to the bottom of the raw WHOIS results to locate the DNSSEC entry:
DNSSEC: signedDelegation– Indicates DNSSEC is active.DNSSEC DS Data:Displays your active DS record parameters (e.g.,2371 13 2 C4D8DC...).DNSSEC: unsigned– Indicates DNSSEC is not active.
Note for other domain extensions (.ORG, .CO, .UK, etc.): If your TLD WHOIS does not display DNSSEC data, please reach out to our Support team and we can check the registry status for you.
How to Check DNSSEC Propagation Worldwide
If we recently published or removed DS records for your domain, it may take up to 24 to 48 hours to propagate across global DNS resolvers.
You can monitor live propagation across global servers:
- Go to DNSChecker.org.
- Select DS from the record type dropdown menu next to the search bar.
- Enter your domain name and click Search.
- Seeing green checkmarks (✅)? Your DS records are actively resolving in those regions.
- Seeing red crosses (❌)? If we just published or updated your record, this simply means the changes are still propagating to those specific global nodes. If you recently requested a DNSSEC removal, red crosses indicate the old records are successfully clearing.
How to Request a DNSSEC Change
To enable, disable, or update DNSSEC DS records for your domain:
- Gather your DS Record details from your DNS/Hosting provider (Key Tag, Algorithm, Digest Type, and Digest).
- Contact Customer Support directly emailing our support email.
Security Requirement: To protect your domain's routing security, all DNSSEC modification requests must originate directly from the verified email address associated with your account. Requests sent from unverified email addresses cannot be processed.
Comments
0 comments
Article is closed for comments.