2 min read
DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring requests are not routed to a spoofed domain.
When you enable DNSSEC, Cloudflare signs your zone, publishes your public signing keys, and generates your DS record.
Step 1 - Activate DNSSEC in Cloudflare
- Log in to the and select your account and domain.
- Go to DNS > Settings.
- For DNSSEC, click Enable DNSSEC.
- In the dialog, you have access to several necessary values to help you create a DS record at your registrar. Once you close the dialog, you can access this information by clicking DS record on the DNSSEC card.
Step 2 — Add DS record to your registrar
Add the DS record to your registrar. If Algorithm 13 - Cloudflare’s preferred cipher choice - is not listed by your registrar, it may also be called ECDSA Curve P-256 with SHA-256.