DNSSEC, explained

What it does

DNSSEC adds cryptographic signatures to your DNS records, so resolvers can verify that answers haven't been tampered with in transit. It protects against DNS spoofing and cache-poisoning attacks — it does not encrypt traffic or protect against phishing look-alike domains.

Turning it on

From your domain's detail page in the panel, open the DNSSEC section:

• Domains using our DNS — one click. We sign the zone and publish the DS record to the registry automatically.
• Domains using external DNS — generate the DS record at your DNS provider, then paste it in.

Disabling DNSSEC

Turning DNSSEC off in the panel removes the DS record from the registry but leaves your zone signed, so re-enabling it later is instant.