DNSSEC signing

Whether the DNS zone is signed, so a forged DNS answer can be detected. Worth having and far from universal — most domains are unsigned, and that is a fact rather than a defect.

• Help center

DNSSEC adds cryptographic signatures to DNS answers. A resolver that validates them can tell a genuine answer for your domain from a forged one, which protects visitors against cache poisoning and certain man-in-the-middle attacks that redirect a domain to a different server.

It is valuable but far from universal: most domains in the world are unsigned, and many hosting setups make it awkward. That is why the report shows an unsigned zone as a neutral fact, not as a problem.

How SiteScan checks

The scan asks for the DS record of the registrable domain — the record the parent zone (for example .com) publishes to vouch for your zone's signing key. If a DS record exists, the zone counts as signed. The same information can also appear in the Domain registration group, where it comes from the registry's own data.

How to enable it

• With most managed DNS providers (Cloudflare, Route 53, many registrars) it is a single switch: the provider signs the zone and either publishes the DS record itself or gives you the values to enter at your registrar.
• If DNS and registrar are separate, copy the DS record exactly; a wrong or stale DS makes the whole domain unresolvable for validating resolvers.
• Before moving the domain to another DNS provider, disable DNSSEC or plan the key handover first.

Related: nameservers and CAA.