DNSSEC (Domain Name System Security Extensions) adds digital signatures to your domain's DNS records, enabling resolvers to detect and reject forged responses so that users always reach the authentic service.
How it works
DNSSEC does not change the DNS query process. Instead, it uses digital signatures and a chain of trust to verify that resolution results are authentic.
The process has two phases:
Configuration phase (administrator action)
-
Enable DNSSEC with your authoritative DNS provider, such as Alibaba Cloud DNS. The system generates keys, signs all records, and produces a DS record — a cryptographic fingerprint of the public key.
-
Submit the DS record to your domain registrar. The registrar then syncs it with the official registry of the top-level domain (TLD), such as
.com.
This is equivalent to registering your public key with a higher-level authority.
Validation phase (automatic)
When a user visits the domain, a DNSSEC-aware resolver:
-
Retrieves the registered DS record (the official fingerprint) from the
.comTLD. -
Retrieves the current public key (DNSKEY) from the domain's DNS provider.
-
Calculates a fingerprint from the public key and compares it with the DS record. If they match, the resolver trusts the response. Otherwise, it rejects the response.
The resolver returns only validated DNS data, preventing DNS cache poisoning and man-in-the-middle attacks.
Procedure
Step 1: Get the DS record
-
If your DNS service is with Alibaba Cloud: On the Public Zone page, find the target domain and click DNSSEC Settings on the right. After you enable DNSSEC, get the DS record from the configuration page.
DNSSEC Settings is in the ⋮ (More) menu in the Actions column.
The configuration page shows four DS record fields: Key Tag, Algorithm, Digest Type, and Digest. Submit these to your domain registrar for DNSSEC to take effect. Expand More DS Record Information to view the Public Key and Flags.
-
If your DNS service is not with Alibaba Cloud: Get the DS record from your DNS provider.
Step 2: Add the DS record
-
Go to the Domain List page, find the target domain, and click Actions in the Manage column. On the DNSSEC Configurations page, click Add DS Record.
-
Enter the DS data from your DNS provider and click Submit.
Each domain supports a maximum of eight DS records.
Step 3: Verify the configuration
-
Recommended verification tool: DNSViz
-
Enter your domain and run the analysis. If DS records appear at every level with no red error boxes, DNSSEC is working correctly.
Manage DNSSEC records
Synchronize DS records
If you transferred a domain to Alibaba Cloud and previously configured DNSSEC at the original registrar, go to the DNSSEC Configurations page and click Synchronize DS Record. This syncs your existing DNSSEC records to Alibaba Cloud without manual entry.
Disable DNSSEC
-
On the domain's DNSSEC Configurations page, delete the DS records.
-
On your DNS provider's console, disable DNSSEC.
Production recommendations
-
If your paid DNS plan is expiring and you do not plan to renew it, delete the DS records at your domain registrar and disable DNSSEC on the Alibaba Cloud DNS console first. Otherwise, domain resolution fails.
-
Before using Domain Transfer Between Accounts to move a domain between Alibaba Cloud accounts, delete the DS records at your domain registrar and disable DNSSEC on the Alibaba Cloud DNS console. Otherwise, domain resolution fails.
-
Before using Cross-account DNS Resolution Transfer to move DNS hosting between Alibaba Cloud accounts, delete the DS records at your domain registrar and disable DNSSEC on the Alibaba Cloud DNS console. Otherwise, domain resolution fails.
FAQ
Why do I need to disable DNSSEC when transferring a domain?
Disable DNSSEC before transferring a domain. DNSSEC relies on the DS record at the domain registrar to validate DNS responses. If you transfer without deleting the DS record, the chain of trust breaks and recursive resolvers reject the responses, causing a service outage. Re-enable DNSSEC after the transfer completes.
Why is the DNSSEC Settings entry for my domain missing in the console?
Your domain's TLD does not support DNSSEC. Supported TLDs: .com, .net, .cc, .tv, .name, .biz, .club, .cn, and .top. If the DNSSEC Settings option does not appear in the Domain Names console, your TLD is not yet supported.