DNSSEC basics

DNSSEC adds a digital signature to your domain's DNS answers, so a visitor's network can tell they're genuine. It works through a DS record held at your registrar that must match keys at your DNS provider. If the two don't match, the domain stops resolving. So the rule is: before changing nameservers, turn DNSSEC off at your registrar and wait for the old DS record to expire (often 24–48 hours). It can be turned on again afterwards.

How DNSSEC works

1. Your DNS provider signs your records with a private key.
2. Your registrar publishes a DS record, a fingerprint of that key, with the registry.
3. When someone looks up your domain, networks that check DNSSEC compare the signature with the DS record.

If they match, the answer is trusted. If the DS record points to a key the new provider doesn't have, checking networks reject every answer, and visitors see a "site can't be reached" error. In technical tools this shows up as SERVFAIL.

Check whether DNSSEC is on

With a web lookup

Look your domain up at ICANN Lookup. The result shows whether the domain is signed (DNSSEC) or not.

With a command

dig ds example.com +short

Replace example.com with your domain. If nothing comes back, there's no DS record and DNSSEC is off. If you see a line of numbers and a long string, a DS record is published.

Turn DNSSEC off before moving DNS

Do this at your registrar, in the domain's DNS or security settings:

• GoDaddy: DNS → DNSSEC.
• Namecheap: the DNSSEC setting under Advanced DNS, for domains on custom DNS.
• Squarespace Domains: you're prompted to turn it off when you choose Use Custom Nameservers; select Continue.
• Porkbun: REGISTRY DNSSEC holds DS records for outside nameservers.
• Dynadot: Clear DNSSEC removes it.
• Name.com: Manage Nameservers → DNSSEC Management.

Then:

1. Remove the DS record (or turn DNSSEC off) at the registrar.
2. Wait for the old record to expire, often 24–48 hours.
3. Check with the lookup above that no DS record remains.
4. Change the nameservers. See How to change your domain's nameservers.

Turn DNSSEC on with Cloudflare

Once your domain is active on Cloudflare, DNSSEC can be enabled again. For domains in Oogle's Cloudflare account, we do the Cloudflare part and send you the DS record. In Cloudflare it's DNS → Settings → Enable DNSSEC, which produces a DS record using algorithm 13 (ECDSA P-256 with SHA-256).

1. Ask us through a Website Support ticket to enable DNSSEC.
2. We send you the DS record details.
3. Add the DS record at your registrar, in the DNSSEC setting listed above.
4. Reply to the ticket so we can confirm Cloudflare sees it.

Domains registered with Cloudflare Registrar get the DS record added automatically.

You'll know it worked when

After turning it off: dig ds returns nothing, and the domain resolves after the nameserver change. After turning it on: ICANN Lookup shows the domain as signed, and the site still loads normally.

Troubleshooting

• The domain stopped resolving right after a nameserver change. Remove the DS record at your registrar, then allow time for old copies to expire. Tell us so we can check from our side.
• You can't find a DNSSEC setting. Search your registrar's help center for "DNSSEC" or "DS record". Some only show it for domains using custom nameservers.
• The registrar asks for fields you don't recognize. Copy each value from our DS record details exactly; ask us if a field doesn't match.
• You're transferring the domain. Some registrars ask you to remove DNSSEC first. See Transfer a domain to another registrar.

Next steps

• Troubleshoot a domain that isn't working
• Connect an existing domain to Oogle hosting