DNSSEC: signed answers for your domain

• Sign-in and payment

  Whoever signs in or pays should land on your website. Validating resolvers reject a forged address.

• Business email

  Your MX and SPF records are signed too. Validating resolvers reject a forged delivery address.

• Your own nameservers

  If the zone runs elsewhere, you enter your provider’s DS data with us. We pass it on to the registry.

1. 1

   Turn it on

   One switch in the customer area, one API call or one request to your AI agent.

   Zone yourname.com

   Example

   • ; DNSSEC turned on
   • @A192.0.2.10
2. 2

   Sign

   We create the keys and sign every record. We renew the signatures before they expire.

   Zone yourname.com

   Example

   • new: +@DNSKEY257 3 …
   • new: +@RRSIGA …
3. 3

   Close the chain

   We add the DS record at the registry and check every 10 minutes until it has taken it over.

   Zone yourname.com

   Example

   • ; DS record added at the registry
   • ; checked: chain complete

For extensions whose registry supports DNSSEC.

Price

Included in every domain, at no extra cost

Extensions

For extensions whose registry supports DNSSEC; the API reports it per domain

With our nameservers

We create the keys, sign the zone and add the DS record at the registry

With your own nameservers

You supply DS or DNSKEY data, we add it at the registry

Signatures

Renewed before they expire; a daily check watches over this

Turning it off

We remove the DS record at the registry first; the signature goes once it is provably gone

As of 29.09.2026.Evidence with source and date