NorthDNS
DNS

Enabling DNSSEC

How to enable DNSSEC on NorthDNS, publish the DS record at your registrar and disable it safely before changing provider.

Why it matters

DNSSEC signs your domain’s DNS answers. Validating resolvers reject forged answers, protecting against cache poisoning.

Turning it on

  1. Open the domain → DNS settings → enable DNSSEC.
  2. NorthDNS generates the keys and signs the zone.
  3. Copy the DS record shown (key tag, algorithm, digest type and digest).
  4. Add it in the DNSSEC section of your registrar.

Until the DS is published DNSSEC stays pending: the domain keeps working, just without validation.

Verification

The panel checks the DNSSEC chain periodically and shows its status. You can also check it with tools such as DNSViz or:

dig DS example.com +short

Before changing provider

Always remove the DS record at the registrar and wait for its TTL to expire before moving the nameservers elsewhere. A DS that does not match the new provider’s keys makes the domain unreachable for validating resolvers.