DNSSEC adds a digital signature to your domain's DNS records, so anyone looking them up can check that the answer really came from your nameservers and wasn't changed on the way. It protects visitors from being quietly sent to a fake website or mail server.
It has two halves: the nameservers sign the records, and the registry holds a DS record that lets everyone check the signature. Both must match, or the domain stops resolving for anyone who checks.
You manage DNSSEC on the DNS tab of your domain's page in My CamCore, under DNSSEC.
If CamCore keeps your DNS
Choose Turn on DNSSEC signing. CamCore signs the records and lodges the matching DS records with the registry for you. Nothing else is needed. It can take a few hours to reach every resolver.
To stop, choose Signing is on: turn off. CamCore removes the DS records as well.
If another provider keeps your DNS
Turn on DNSSEC with that provider first. They give you one or more DS records, each with four parts:
| Part | What it is |
|---|---|
| Key tag | A number that identifies the key. |
| Algorithm | The signing method, such as 13 (ECDSA P-256 SHA-256). |
| Digest type | The hash used, usually 2 (SHA-256). |
| Digest | A long string of letters and numbers. |
Enter them exactly as given and choose Add DS record. CamCore lodges them with the registry.
A wrong DS record makes the domain stop resolving for anyone whose DNS checks signatures. Copy and paste rather than typing, and ask CamCore Support if you are unsure.
Before you change DNS provider or nameservers
Turn DNSSEC off, or remove the DS records, before moving the domain to different nameservers, unless the new provider has told you they will use the same keys. Otherwise the old DS records won't match the new provider's signatures and the domain stops working. Turn it back on with the new provider once the move is complete.