Enabling Cloudflare DNSSEC with the correct registrar DS record

Confirm Cloudflare is active and authoritative and that the registrar supports the required DNSSEC settings. Keep registrar access available and document any existing DS records before changing them.

1. Open the domain’s DNS > Settings page and enable DNSSEC.
2. Copy the displayed DS details exactly, including key tag, algorithm, digest type and digest.
3. Publish the DS through the registrar’s DNSSEC workflow where manual entry is required. Some supported registrar arrangements automate this step, so check the actual status before adding duplicates.
4. Verify the parent DS and Cloudflare DNSKEY relationship using a validating DNS diagnostic. Test website and mail resolution from an independent resolver.
5. Record the configuration for future nameserver changes. Plan DNSSEC migration before moving to another DNS provider.

The domain should resolve through validating resolvers with a valid chain of trust. A panel toggle alone does not prove the registrar’s DS is correct.

If validation fails, compare the active DS with Cloudflare’s current values. For a controlled disable, remove the parent DS first and keep zone signing active until its cached TTL expires. Do not immediately switch nameservers while an incompatible DS remains cached.

Before moving a signed domain, check both the current DNS provider and the domain's registrar settings. The signing configuration and the parent-zone DS record must agree. Copying ordinary A, MX and TXT records does not transfer that trust relationship by itself.

Record the existing state and follow the providers' supported migration procedure. Do not copy the old provider's DS values into the new provider's setup merely because the domain name is unchanged. The new signing keys may be different.

Why can the site fail for some visitors but not others?

A validation problem can be visible through resolvers that enforce DNSSEC while a non-validating check appears normal. Compare responses from the authoritative service and a validating resolver. Preserve the actual error, such as a failure response, rather than treating it as ordinary website downtime.

Ask us for help before changing a signed domain that carries important website or email traffic. Include the domain and whether nameservers, signing or DS records were recently changed. Do not send private signing keys. After the migration, verify the public chain and test website and mail service separately so that a repaired DNS response is not mistaken for a complete application check.

DNSSEC authenticates DNS data and its integrity. It does not itself encrypt the lookup or replace HTTPS for the website.

• Editing a Cloudflare DNS record and verifying authoritative answers
• Exporting a Cloudflare DNS zone before migration
• Temporarily pausing Cloudflare for a controlled diagnosis
• Using a wildcard DNS record without overriding explicit hostnames

• Cloudflare: Dnssec
• Cloudflare: Troubleshooting