What is DNSSEC?
DNSSEC is a digital signature on the DNS data of your domain. DNS tells computers where your website and your email are located. Without DNSSEC, someone could theoretically give a false answer, secretly sending visitors or mail to a different server. With DNSSEC, the visitor's computer checks whether the answer really comes from your nameservers.
How does it work, in plain language?
- Your nameservers put a signature under every answer. For that, they have a secret key. The matching public key is in your DNS (the DNSKEY record).
- At the registry of your extension, such as SIDN for .nl, there is a fingerprint of that key: the DS record. That way everyone knows which key belongs to your domain.
- The registry itself is also signed, all the way up to the top of the internet. This creates a chain of trust.
- Many internet providers and public DNS services (such as those from Google and Cloudflare) check that chain with every answer. If the signature matches, everything just proceeds. The visitor notices nothing.
What can go wrong?
If the fingerprint at the registry no longer matches the key of your nameservers, checking providers will reject every answer. Your website and email then become unreachable for a large part of the internet, while it still works for others. That makes it hard to spot.
This almost always happens after a move or a change of nameservers: the old fingerprint remains at the registry, but the new nameservers use a different key. So before you move, read DNSSEC and moving: turn it off first, or bring the key along.
DNSSEC at WebOké
- If you use WebOké's nameservers, we sign your DNS automatically. You turn on DNSSEC with a single click, see Activating DNSSEC.
- You can check whether the keys match in My WebOké on the domain page. If you see a red dot next to DNSSEC under Domain / Email health, you can fix it with the Update key at registry button.
- DNSSEC is also needed for DANE, which makes your mail extra secure, and for a 100% score on internet.nl.
Detailed explanation with screenshots: DNSSEC and DANE in the WebOké manual.
Might be interesting to read: The history of the Domain Name