In this article, you will learn:
- What DNSSEC is
- How to set up DNSSEC on a domain
- How to set up DNSSEC in bulk
- Common problems
- Frequently Asked Questions
DNSSEC
DNSSEC is a method of protecting a domain against DNS spoofing attempts. It uses security keys to ensure that the information obtained from DNS is complete, comes from the correct source, and has not been tampered with by any third party during transmission.
You can set up DNSSEC for all domains that support this method:
- all CZ and EU domains that we register;
- all SK and gTLD domains (including nTLD) that we register but that do not use our DNS servers.
PL domains do not currently support DNSSEC.
Setting up DNSSEC on a domain
Setting up DNSSEC protection usually takes up to 6 hours.
You can set up DNSSEC under the following conditions:
- CZ and EU domains must be registered with us and may, but do not have to, use our DNS servers.
- SK domains and generic domains (COM, NET, WEBSITE, …) must be registered with us, but must not use our DNS.
To open the DNSSEC settings, follow these steps:
- Log in to the Customer Administration ⧉.
- In the top menu, select Domains.
- In the overview, select the domain on which you want to set up DNSSEC.
- In the left menu, select DNSSEC settings.
Then continue according to the instructions for your domain extension:
Activating DNSSEC on CZ and EU domains
For domains with the CZ and EU extensions, DNSSEC is set up automatically by default. If you want to turn off the automatic setup, uncheck, in the section Customer Options the option Allow future automatic setup/cancellation of WEDOS DNSSEC.
For CZ and EU domains, we offer a complete DNSSEC solution. In this case, both the domain and the DNS servers (NSSET) must be managed by WEDOS.
In the DNSSEC settings interface, check the option use WEDOS DNSSEC and click the Set DNSSEC.
button. For these domains, you can also, in the box of the same name, set future automatic setup/cancellation of WEDOS DNSSEC in case the system detects problems with DNSSEC.
If you do not use WEDOS DNS servers (NSSET), you can use an existing custom KEYSET, or create and use your own KEYSET. The signing of DNS records on the DNS servers is handled by the DNS service provider or the domain administrator (customer).
Activating DNSSEC on SK domains and generic domains
For SK, gTLD, and nTLD domains, we offer the option to activate DNSSEC, but you must have your DNS servers set up with another provider. Also obtain the Digest or Public key type keys from this provider (if it supports DNSSEC). The signing of DNS records on the DNS servers is handled by the DNS service provider or the domain administrator (customer).
In the DNSSEC settings interface, follow these steps:
- Check the option use custom DNSSEC keys.
- In the table Vlastní DNSSEC klíče vyberte typ klíče a zadejte odpovídající hodnoty.
- Save the settings by clicking the Set DNSSEC.
Deactivating DNSSEC
In the DNSSEC settings interface, check the option do not use DNSSEC and click the Set DNSSEC.
Bulk DNSSEC setup
Currently, bulk DNSSEC setup is supported only for CZ and EU domains that are registered with us. We recommend using our DNS servers.
To set up DNSSEC in bulk, follow these steps:
- Log in to the Customer Administration ⧉.
- In the top menu, select Domains.
- V přehledu zaškrtněte CZ a EU domény, u kterých chcete DNSSEC hromadně nastavit.
- At the bottom of the table, select DNSSEC settings.
- Click the Execute.
In the following wizard, enter the required settings and confirm them with the Finish.
Common problems
Common DNSSEC problems include:
SK or gTLD with WEDOS DNS
Problem: The following error message is displayed: ERROR: DNSSEC for this domain is enabled only when using external DNS servers. None of our DNS servers may be used for the domain.
Cause: You can set up DNSSEC on SK and generic domains (COM, NET, ONLINE, …) only if you do not use our DNS servers.
Solution: Change the DNS servers to another provider that supports DNSSEC.
Frequently Asked Questions
Can I use my own KEYSET for CZ and EU domains?
Yes, but you must not use our DNS servers.
Why do I have to use external DNS servers for generic domains?
For technical reasons, it is not possible for us to sufficiently automate the DNSSEC setup process for gTLD domains. The registries of CZ and EU domains support KEYSET objects, which allow us to rotate DNSSEC keys in the parent zone in bulk for all affected domains with a single command. With other registries, we would have to replace the keys individually for each domain, and in some cases this might not even succeed because of possible restrictions imposed on domains by the registry. A key rotation that is not carried out could then make the domain unavailable because of a broken chain of DNSSEC keys.
How do I turn DNSSEC off?
In the DNSSEC settings interface, check the option do not use DNSSEC and confirm. As with all DNSSEC settings, this takes effect within a few hours.
How does DNSSEC cancellation work?
The system sends the command to remove the DNSSEC keys from the parent zone to the registry immediately. If the domain uses our DNS servers, after the command is sent you wait for the TTL of the DNSSEC keys in the parent zone to expire. Once the TTL has expired, the system removes the zone signature on our DNS servers, which completes the request to cancel DNSSEC for the domain. While the cancellation request is being processed, you cannot change the DNSSEC settings of the domain in any way.