Build it yourself · Part 1Checked: 30 October 2026

Chapter 2: DNS hosting with DNSSEC

Why

Your domain's records say where dns.<your-domain> lives. DNSSEC signs those records, so nobody between your device and the answer can quietly point your resolver's name somewhere else.

Our choice, and the alternatives

We host our domain's records at deSEC: a non-profit in Berlin, free to use, paid for by donations and sponsors. It signs everything with DNSSEC by default, and it has an interface for scripts, which you'll need if you ever add a second server (see "Going further").

Alternatives: your registrar's own DNS, or your server provider's DNS. Both work. Check that they offer DNSSEC, and remember that whoever hosts your records can see which of your names are looked up.

What you need

The domain from chapter 1, and access to its settings at your registrar.
About 30 minutes, plus waiting time while the changes spread (our estimate).

Steps

Do them in this order. The order matters: while the nameservers and the DS record point to different signers, your domain stops working (see Pitfalls).

Create a deSEC account and turn on two-factor login.
Add your domain in deSEC. deSEC creates the zone and shows its DS record: four values called key tag, algorithm (13), digest type (2) and digest.
At your registrar, check for a DS record of its own. Some registrars sign domains themselves. If yours has one, switch the registrar's DNSSEC off (remove its DS record), then wait a day: resolvers may remember the old DS record that long. A brand-new domain without a DS record can skip this step.
At your registrar, set the nameservers of your domain to:
```
ns1.desec.io
ns2.desec.org
```
At your registrar, enter deSEC's DS record: key tag, algorithm 13, digest type 2, and the digest, copied exactly from deSEC. If your registrar asks for other fields, check deSEC's documentation.

A faster way, if your registrar lets you list two DS records: add deSEC's next to the old one, switch the nameservers, and remove the old one a day later. That's how DNSSEC keys are normally changed, but we haven't tried it.

How you know it worked

Wait a while after step 5: changes at the registry can take hours to show everywhere. Then, in a terminal on your Mac (dig is already installed):

dig NS <your-domain> +short

shows ns1.desec.io. and ns2.desec.org.

dig +dnssec SOA <your-domain> @1.1.1.1

shows ad among the flags, near the top of the answer (;; flags: qr rd ra ad;). ad means the answer was checked and the signatures are valid. Try the same with @9.9.9.9 and @8.8.8.8, which are other public resolvers.

If ad is missing, or you get SERVFAIL, read the Pitfalls before you change anything else.

Pitfalls

The registrar's old DS record breaks your domain. We switched the nameservers to deSEC while our registrar's own DS record was still in place. Resolvers then found signatures that didn't match it and refused to answer (SERVFAIL). Our domain stopped resolving until we removed it. That's why step 3 comes first, with a day's wait.
deSEC first allows one domain. It lets you add more once it has seen your first one delegated to it with DNSSEC working. Set up one domain completely before adding the next.

Time and cost

About 30 minutes (our estimate), plus waiting: a day, if your registrar had its own DS record.
deSEC is free. Consider a donation if you keep using it.

Text: CC BY-SA 4.0 · Commands and configs: CC0