# Ensure DNSSEC is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787219587768-ensure-dnssec-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure DNSSEC is enabled for the zone and that the DS record is added at your domain registrar, so that DNS answers for the domain are cryptographically signed and can be verified by resolvers.

**Rationale**

Without DNSSEC, attackers can forge DNS responses through cache poisoning or spoofing and send visitors to malicious servers without them noticing. DNSSEC signs DNS records so that resolvers can detect and reject forged answers, protecting users from being redirected to fake sites.

**Impact**

-   DNS answers can be verified by resolvers
    
-   Protects against DNS spoofing and cache poisoning
    
-   An incorrect DS record at the registrar can make the domain unreachable
    

**Default Value**

By default, DNSSEC is not enabled. Domains registered with Cloudflare Registrar can have the DS record added automatically.

**Pre-Requisites**

-   Cloudflare account with Administrator or DNS permissions for the zone
    
-   Access to your domain registrar to add the DS record
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Settings.
    
4.  On the DNSSEC card, verify that DNSSEC is enabled and active, not pending.
    
5.  If it is disabled or pending, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Settings.
    
4.  For DNSSEC, select Enable DNSSEC.
    
5.  Copy the DS record values shown in the dialog. You can view them again later by selecting DS record on the DNSSEC card.
    
6.  Sign in to your domain registrar and add the DS record (Algorithm 13 may be listed as ECDSA Curve P-256 with SHA-256). If your domain uses Cloudflare Registrar, Cloudflare adds it automatically, which can take one to two days.
    
7.  Wait for DNSSEC to show as active in Cloudflare.
    

**Backout Plan**

1.  Sign in to your domain registrar and remove the DS record first.
    
2.  Wait for the change to propagate (usually up to 24 hours or the DS record's TTL).
    
3.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
4.  Select your account and the domain (zone) you want to review.
    
5.  Go to DNS > Settings and select Disable DNSSEC.
    

**Reference**

-   [https://developers.cloudflare.com/dns/dnssec/](https://developers.cloudflare.com/dns/dnssec/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.