Cloudflare Docs
DNS
Visit DNS on GitHub
Set theme to dark (⇧+D)

DNSSEC

DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring requests are not routed to a spoofed domain.


​​ Disable DNSSEC

If you are onboarding an existing domain to Cloudflare, make sure DNSSEC is disabled at your registrar (where you purchased your domain name). Otherwise, your domain will experience connectivity errors when you change your nameservers.

Provider-specific instructions

This is not an exhaustive list of how to update DS records in other providers, but the following links may be helpful:

Why do I have to disable DNSSEC

When your domain has DNSSEC enabled, your DNS provider digitally signs all your DNS records. This action prevents anyone else from issuing false DNS records on your behalf and redirecting traffic intended for your domain.

However, having a single set of signed records also prevents Cloudflare from issuing new DNS records on your behalf (which is part of using Cloudflare for your authoritative nameservers). So if you change your nameservers without disabling DNSSEC, DNSSEC will prevent Cloudflare’s DNS records from resolving properly.


​​ Enable DNSSEC

When you enable DNSSEC, Cloudflare signs your zone, publishes your public signing keys, and generates your DS record.

​​ Step 1 - Activate DNSSEC in Cloudflare

  1. Log in to the Cloudflare dashboard and select your account and domain.
  2. Go to DNS.
  3. For DNSSEC, click Enable DNSSEC.
  4. In the dialog, you have access to several necessary values to help you create a DS record at your registrar. Once you close the dialog, you can access this information by clicking DS record on the DNSSEC card.

​​ Step 2 — Add DS record to your registrar

You now need to add a DS record to your registrar.

Provider-specific instructions

This is not an exhaustive list of how to update DS records in other providers, but the following links may be helpful:

​​ Troubleshooting

For more help with DNSSEC, refer to Troubleshooting DNSSEC.

​​ Limitations

If your registrar does not support DNSSEC with Cloudflare’s preferred cipher choice (Algorithm 13), you have several options:

If your top-level domain does not support DNSSEC with Algorithm 13, contact that top-level domain.