DNS Security Extensions (DNSSEC) at DNSimple

Last updated October 26, 2026

Table of Contents

• What is DNSSEC?
• How to manage DNSSEC
• DNSSEC compatibility with other DNSimple features
• Troubleshoot DNSSEC configurations
• Reference articles
• Related articles
• Have more questions?

DNSSEC (Domain Name System Security Extensions) adds digital signatures to your DNS records, so validating resolvers can reject forged answers such as those used in cache poisoning. DNSSEC at DNSimple is available on all plans. When you enable it, we sign your zone, rotate the keys automatically, and, if your domain is registered with DNSimple, manage the DS record at the registry for you. If another provider signs your zone, you can add its DS records to a domain registered with DNSimple in either DS-data or KEY-data format.

What is DNSSEC?

If you are new to DNSSEC, these articles will help you understand the fundamentals.

• What Is DNSSEC and How Does It Work?: Learn what DNSSEC is and why it matters.
• The DNSSEC Chain of Trust: How signed links from the root zone down to your domain let resolvers trust your DNS data.
• What Are DS Records?: The role of Delegation Signer (DS) records in linking your domain to its parent zone.
• DNSKEY Records Explained: The records that hold the public keys used to verify DNSSEC signatures.
• What Are the Types of DNSSEC Keys?: The Zone Signing Key and Key Signing Key, and why DNSSEC uses both.
• What Are RRSETs and RRSIGs in DNSSEC?: How DNSSEC signs groups of records and how resolvers check the signatures.
• What Are NSEC and NSEC3 Records?: How DNSSEC proves that a name doesn’t exist, and the compact answers DNSimple uses.
• What Are CDS and CDNSKEY?: How these records help parent zones keep DS records up to date.
• What Is DANE and How Does It Work?: How DANE uses DNSSEC-signed records to authenticate TLS certificates.
• Why DNSSEC and Secondary DNS May Not Work Together: Compatibility considerations when using DNSSEC with secondary DNS.

How to manage DNSSEC

Ready to use DNSSEC? These articles walk you through each task.

• Enable DNSSEC: Turn DNSSEC on for your domain.
• Disable DNSSEC: Turn DNSSEC off for your domain without breaking resolution.
• Add and Remove DS Records: Add or remove DS records from another DNS provider for a domain registered with DNSimple.
• Manage DS Records When Changing DNS: Update DS records when you move your DNS hosting to a different provider.
• Use Cloudflare DNSSEC with DNSimple: Set up Cloudflare DNSSEC when your domain is registered with DNSimple.
• Rotate DNSSEC Keys: How automatic key rotation works and when you need to update DS records yourself.

DNSSEC compatibility with other DNSimple features

Not all DNSimple features are compatible with DNSSEC. Before enabling DNSSEC, review the compatibility details for your setup.

• DNSSEC Compatibility With Other DNSimple Features: Which DNSimple features work with DNSSEC, and their limitations.

Troubleshoot DNSSEC configurations

Having trouble with your DNSSEC setup? Start here.

• Troubleshoot DNSSEC: Diagnose and fix common DNSSEC problems, such as a DS record that doesn’t match your keys.
• External DNSSEC Diagnostic Tools: Test your domain’s chain of trust with DNSSEC Analyzer, DNSViz, and dig.

Reference articles

Look up the details of the DNSSEC screens in your DNSimple account and the terms used in DNSSEC.

• DNSSEC Management in DNSimple: Each part of the DNSSEC tab and DS record pages, labeled.
• DNSSEC Glossary: Definitions of common DNSSEC terms.

Related articles

• DNS at DNSimple: The zone and the records that DNSSEC signs.
• Name Server Management at DNSimple: Moving DNS to another provider means updating the DS records at the registry.
• SSL Certificates: DANE uses DNSSEC-signed records to authenticate TLS certificates.

Have more questions?

If you have any questions about DNSSEC, just contact support, and we’ll be happy to help.