Also called Domain Name System Security Extensions · DNS Security Extensions
DNSSEC, explained
The domain's DNS host signs its records, and a DS (delegation signer) record, submitted to the registry through the registrar, links the parent zone, such as .com, to the domain's keys. Validating resolvers follow that chain of signatures; if it breaks, they refuse to answer and the domain stops resolving for their users. DNSSEC authenticates DNS data and protects against forged answers; it does not encrypt anything.
For a domain investor, DNSSEC matters mostly during moves. If a name has DNSSEC enabled and you change its nameservers, for example to a parking or lander service or to a buyer's DNS host, while the old DS record is still at the registry, the name can stop resolving. Turn DNSSEC off at the registrar and let the change take effect before switching nameservers or handing a domain over, then let the new DNS host enable it again.
Example. A sold domain that resolves for some visitors but fails for others right after a nameserver change often still has an old DS record at the registry.
Free to read, no signup. The list is for news of the course itself.
Join the waitlistSources
Education, not financial, legal or tax advice. Domain investing is speculative and most domain names never sell. Read the disclaimer.