Skip to content
WebShield Docs
Menu
Start
OverviewQuick start
Guides
Publishing a static siteHome server on a dynamic address
Domain setup
Transfer domain controlConnect without changing nameserversDNS recordsDNSSECDynamic IP (DynDNS)CDN and protectionOrigin access through WebShield only
Static sites
Hosting static sitesForms
Object storage
Object storage (S3)AWS CLIrclones3cmdSDKs
CLI
Command-line client
Control panel
StatisticsAudience analyticsAI search visibilityBot and click-fraud protectionInvalid traffic and fraudSite scriptForm and sign-up protectionKnown bots accessBilling and plansProfile and settingsAPI tokensSupport
Help
Site under attackTroubleshooting

DNSSEC

How to enable DNSSEC signing for your domain in WebShield and publish the DS record at your registrar.

DNSSEC adds cryptographic signatures to DNS responses so resolvers can verify that records for your domain have not been forged. WebShield signs responses on every nameserver in real time; you only need to enable signing and publish one DS record at your registrar.

Enable DNSSEC

Section titled “Enable DNSSEC”
  1. Open Control panel → DNS for the domain.
  2. In the DNSSEC card, click Enable DNSSEC.
  3. Copy the DS record shown in the card (the SHA-256 variant, digest type 2, is recommended).
  4. Publish the DS record in your registrar’s control panel (usually under DNSSEC, DS records, or similar).

Until the DS record is published, the zone is signed but resolvers do not validate it — this state is safe and nothing changes for your visitors. Once the registrar publishes the DS record in the parent zone, validation becomes active. The card shows whether a DS record is currently visible in the parent zone.

Technical details: a single CSK key, algorithm 13 (ECDSA P-256 with SHA-256), NSEC3 in narrow mode (zone contents cannot be enumerated).

Disable DNSSEC

Section titled “Disable DNSSEC”

Disabling signing while the DS record is still published would make the domain unresolvable for validating resolvers (a large share of the Internet). The panel therefore blocks disabling until the DS record disappears from the parent zone:

  1. Remove the DS record at your registrar.
  2. Wait for the DS TTL to expire (typically up to 24 hours).
  3. Click Disable in the DNSSEC card.

Transferring a signed domain to WebShield

Section titled “Transferring a signed domain to WebShield”

If your domain already has DNSSEC enabled at the previous DNS provider, remove the DS record at the registrar before switching nameservers to WebShield, and wait for its TTL to expire. Otherwise validating resolvers will reject the unsigned answers from the new nameservers. After the transfer you can enable DNSSEC in WebShield and publish the new DS record.

From the terminal

Section titled “From the terminal”

The CLI does the same — it needs a token with the dns scope:

Terminal window
webshield dns dnssec status example.com    # state and the DS records for your registrar
webshield dns dnssec enable example.com
webshield dns dnssec disable example.com   # refused while the DS is visible in the parent zone