DNSSEC in plain language

DNSSEC is a way to sign your DNS zone so a middleman cannot easily forge records on the path to the visitor. Your zone holds key material and signatures, and the parent domain holds a matching DS record that points at those keys. When those pieces agree, validating resolvers can trust the answers. When they disagree, the same resolvers return SERVFAIL and the domain looks dead worldwide, which is worse than leaving DNSSEC off.

What gets signed in the zone

On shared hosting, cPanel can sign the zone for you. It places DNSKEY records and RRSIG signatures in the zone it serves. That is only half of the chain of trust. Until a matching DS record exists at the TLD, validators have nothing solid to hang those signatures on, and resolvers that do not validate simply ignore the signatures. In practice you work in two places: the hosting DNS panel signs the zone, and the registrar publishes the DS. Both sides must describe the same key.

Why the DS at the parent must match

The DS record is a hash of the key in use. If the zone is signed with a different key than the DS describes, validating resolvers fail the lookup. Enabling DNSSEC at the registrar while the zone is still unsigned creates the same outage in reverse: the parent says signatures should exist, and the child has none. Turn one side on or off only when you have a clear sequence, not because you noticed a checkbox while changing a TTL.

dig example.com +dnssec +short

You want ordinary records plus an RRSIG when the zone is signed, and a DS at the TLD that matches the key in use. You can check the parent with dig example.com DS. Empty DS with local signatures means the zone is signed but not delegated. DS with no signatures is the classic SERVFAIL shape.

How a key rollover should go

Introduce the new key in the zone first, then wait until resolvers have seen it. Update the DS at the parent next, wait again, and only then retire the old key. Skipping the wait steps is a common way to go dark. Split-horizon setups and stub resolvers can keep serving or caching the old DS longer than you expect. If only the office broke after a rollover, see our note on split-horizon DNS and preview hosts.