Description

Ensure DNSSEC is enabled for the zone and that the DS record is added at your domain registrar, so that DNS answers for the domain are cryptographically signed and can be verified by resolvers.

Rationale

Without DNSSEC, attackers can forge DNS responses through cache poisoning or spoofing and send visitors to malicious servers without them noticing. DNSSEC signs DNS records so that resolvers can detect and reject forged answers, protecting users from being redirected to fake sites.

Impact

  • DNS answers can be verified by resolvers

  • Protects against DNS spoofing and cache poisoning

  • An incorrect DS record at the registrar can make the domain unreachable

Default Value

By default, DNSSEC is not enabled. Domains registered with Cloudflare Registrar can have the DS record added automatically.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • Access to your domain registrar to add the DS record

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Settings.

  4. On the DNSSEC card, verify that DNSSEC is enabled and active, not pending.

  5. If it is disabled or pending, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Settings.

  4. For DNSSEC, select Enable DNSSEC.

  5. Copy the DS record values shown in the dialog. You can view them again later by selecting DS record on the DNSSEC card.

  6. Sign in to your domain registrar and add the DS record (Algorithm 13 may be listed as ECDSA Curve P-256 with SHA-256). If your domain uses Cloudflare Registrar, Cloudflare adds it automatically, which can take one to two days.

  7. Wait for DNSSEC to show as active in Cloudflare.

Backout Plan

  1. Sign in to your domain registrar and remove the DS record first.

  2. Wait for the change to propagate (usually up to 24 hours or the DS record's TTL).

  3. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  4. Select your account and the domain (zone) you want to review.

  5. Go to DNS > Settings and select Disable DNSSEC.

Reference