DNSSEC: what it is, why to turn it on and how to add the DS record at your registrar

Without DNSSEC, a DNS answer ("the site is at this IP", "mail goes to this server") carries no signature, so anyone on the path can replace it. With DNSSEC every answer is signed, and the domain's registry (NASK for .pl, for example) holds a hash of the key — the DS record. A validating resolver (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 and many internet providers) follows the chain of trust from the registry to your zone and rejects an answer that does not match.

DNSSEC is also one of the criteria for an AI-ready site: scanners only accept the DNS-AID records that let agents find a domain's MCP server when they carry the AD flag, which means a valid signature.

For domains on the ns3.aderlo.cloud and ns4.aderlo.cloud nameservers, Aderlo Cloud's team turns DNSSEC on for now — write to support from the panel. In the panel, under Domains → DNSSEC & AI, you see each step and the values to copy.

1. 1

   We sign the zone

   with an ECDSA P-256 key (algorithm 13) and check that both nameservers serve the same valid signatures.

2. 2

   We wait an hour

   so resolver caches already hold signed records before a DS appears at the registry.

3. 3

   The DS record

   for a domain registered with us we add it through the registrar API (in .pl it usually appears within minutes); for a domain at another registrar, you add it — see below.

4. 4

   We check the chain

   on three public resolvers. When all of them confirm the signature, the panel says Active.

Signatures are refreshed automatically every week and after every record change, and their validity on both nameservers is checked every hour.

If the domain is registered elsewhere but uses Aderlo Cloud's nameservers, the panel shows four values once the zone is signed. Enter them in the DNSSEC (sometimes "DS records") settings at your registrar.

Some registrars ask for the public key (DNSKEY: flags 257, protocol 3, algorithm 13 and the key) instead of the DS. The panel shows that record too.

Do not change the nameservers while the DS record is at the registry. The new servers do not have your keys, so validating resolvers treat the domain as forged: the site and mail stop working for a large share of users for up to a day. Order: remove the DS → wait 24 hours → change the nameservers.

• •Moving the domain to another registrar or host: turn DNSSEC off first. Aderlo Cloud will not move a domain between accounts while its DS is active — it waits and finishes the move once it is safe.
• •Change DNS records only in the panel or in DirectAdmin — each change is then re-signed on both nameservers right away.
• •Switching off takes about two days: the DS leaves the registry first and the signature stays until every cache has forgotten the old DS.

• •DNSViz — draws the whole chain from the root to the domain; everything should be marked secure.
• •Verisign DNSSEC Analyzer — a checklist; every row should be green.
• •In a terminal: dig +dnssec yourdomain.com @1.1.1.1 — the answer should carry the ad flag.