DNSSEC

DNSSEC

DNSSEC cryptographically signs a domain's DNS records so a resolver can verify that an answer really comes from your zone and was not tampered with along the way. The DNSSEC switch is on the domain's detail page in the panel, in the security-toggles section. The DS and DNSKEY records DNSSEC creates show up as locked in the DNS editor – only this toggle manages them.

Default state

For new domains, DNSSEC in CloudWeb is enabled by default.

Turning it on or off

1. In the left-hand menu, open Domains and click a specific domain.
2. Find the DNSSEC toggle.
3. Click it to enable or disable it.

After enabling, you'll see the message "DNSSEC has been enabled." and the system attempts to hand the corresponding DS record over to the domain's registrar. After disabling, the DS record is removed from the registry and you'll see "DNSSEC has been disabled."

DNSSEC only does anything useful once the domain actually uses CloudWeb's nameservers – if the domain isn't delegated to CloudWeb, turning the toggle on signs the zone, but the registrar and resolvers cannot verify it until the domain is delegated (see DNS records: what they are and how they work).

Domain registered with CloudWeb vs. elsewhere

For DNSSEC to actually work, signing the zone is not enough – the parent domain (e.g. .sk) needs a DS record in the registry pointing at your signing key.

• Domain registered with CloudWeb, at a registrar that supports DNSSEC – once you enable the toggle, the system sends the DS record automatically and writes it to the registry. The same section shows whether the signature has been verified by resolvers yet.
• Domain registered with CloudWeb at a registrar without DNSSEC support, or a domain registered with another provider – automatic hand-off is not possible. In that case, the panel shows a card right under the toggle, "Enter these DS records at your registrar", with the values as key tag, algorithm, digest type and digest, plus a copy button. These values need to be entered by hand in the DNSSEC/DS section at your registrar.

Verification status

While DNSSEC is enabled, the panel also shows the current status of the trust-chain check – for example that the domain is signed and validated by resolvers, that the DS record is already in the registry and validation is about to start, or that the zone is signed but the DS record is not yet in the registry. The message includes when it was last checked.