Every time someone types your domain, their device asks the DNS system "where does this live?" and trusts whatever answer comes back. DNSSEC exists because, by default, nothing proves that answer is real.
What it does. DNSSEC attaches a digital signature to your domain's DNS records. A resolver that supports it can check the signature and confirm the answer came from your DNS and wasn't altered on the way. A forged answer fails the check and is thrown away.
What it stops. Cache poisoning and DNS spoofing , attacks where someone slips a fake record into a resolver so that visitors typing your real domain land on a server the attacker controls, often a convincing copy of your site or login page.
What it doesn't do. It doesn't encrypt traffic, doesn't secure your website or email, and isn't a replacement for SSL. It verifies DNS answers and nothing else.
How it fits together. Your DNS host signs the zone and produces a DS record. That DS record is published at the registry via your registrar. Trust chains from the root, to the extension, to your domain. Every link has to match.
Should you turn it on? For a brochure site it's optional. If you take payments, hold customer data, or run email for an organisation where impersonation would hurt, it's worth enabling.
The warning you must read. DNSSEC fails closed. If the DS record at the registrar stops matching the keys your DNS host is using, resolvers reject the domain entirely. Not a slowdown a complete outage that looks exactly like an expired domain.
The usual cause is moving DNS to a new provider and forgetting the DS record. So the safe order is: remove the DS record at the registrar, wait for it to clear, then move DNS, then publish the new DS record.
Managing it with us. Domains > My Domains > (domain) > DNSSEC / DS Records. If you're unsure whether your domain is signed, open a ticket before changing nameservers, not after.
