DNS

Does PhotonSpark support DNSSEC, and what does it actually do?

Yes. DNSSEC cryptographically signs your DNS responses so validating resolvers detect tampering. It does NOT encrypt queries — that is DoH/DoT's job.

What DNSSEC does

DNSSEC signs every record in your zone with a private key. Validating resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, most enterprise resolvers) check the signature against a chain of trust rooted at the global DNS root.

Protects against: cache poisoning, on-path tampering, fake responses from rogue resolvers.

Does NOT do: encryption (queries are still cleartext over UDP — DoH/DoT handles that), eavesdropping prevention, application-layer trust (TLS still matters).

Enabling DNSSEC on our zones

  1. Open a ticket asking for DNSSEC. We sign your zone within 1 business hour.
  2. We give you a DS record (algorithm, key tag, hash).
  3. You add the DS record at your registrar to complete the chain of trust.
  4. Use Verisign Labs DNSSEC Analyzer to confirm validity.

Disabling DNSSEC

Disable at the registrar first (remove the DS record). Wait for the parent zone TTL (usually a few hours). Then ask us to stop signing. Wrong order causes SERVFAIL across the internet until you correct it.

Migrating a DNSSEC-enabled zone

If your zone is signed elsewhere and you want to keep DNSSEC during migration, see the DNS migration article — there is a multi-step procedure to avoid downtime. Short version: disable DNSSEC, migrate, re-enable. Keys are not transferable between providers.

Caveats

  • Domain registrars that do not support DNSSEC for your TLD cannot host the DS record. Check before enabling.
  • Some legacy resolvers do not validate; they will treat the zone as unsigned. That is OK — they just lose the security benefit.