andreashagen
By:
andreashagen

Does DigitalOcean DNS support DNSSEC, and how do I turn it on?

July 25, 2015 7.1k views
DNS DigitalOcean

So lets assume I'm using ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com as my nameserves for example.com. Now how do I enable DNSSEC for example.com, assuming this is even supported with these nameserves?

3 comments
  • martin.jozef November 21, 2015

    This is a good question!
    I came across this because I just subscribed to google domains. As soon as I have configured DO nameservers I also have the option to configure DNSSEC.

    The site states the following:
    Domain Name System Security Extensions (DNSSEC) protect your domain from attacks such as DNS cache poison attacks and DNS spoofing. Your DNS provider can provide you with the values you need to activate DNSSEC.

    Does DO provides such values that I can use to active DNSSEC?

  • eexit December 6, 2015

    Hello,

    I'm also interested on how to enable DNSSEC on my domains. I left a hosting solution/registrar that allowed me to enable DNSSEC in a single click and I would like to know if DO could provide such thing or a guide to do it.

    Thanks!

  • yaeykay May 15, 2016

    Features like this should be added on DigitalOcean. +1

Log In to Comment
3 Answers
kamaln7 MOD November 22, 2015

Unfortunately DigitalOcean's nameservers do not support DNSSEC currently. You can vote for this feature and subscribe to notifications regarding any progress on it on our suggestions board:

If you still want to implement DNSSEC right now, you could use any nameservers that do support it such as Rage4.

Another option would be hosting your own Authoritative DNS Server with DNSSEC support:

Good luck!

How To Setup DNSSEC on an Authoritative BIND DNS Server
by Jesin A
We all know that DNS is a protocol which resolves domain names to IP addresses, but how do we know the authenticity of the returned IP address? It is possible for an attacker to tamper a DNS response or poison the DNS cache and take users to a malicious site with the legitimate domain name in the address bar.
Reply
ben2020 March 13, 2018

The fact that Digital Ocean name servers don't support DNSSEC can be a major issue. Some registrars will enable DNSSEC by default, and if you use Digital Ocean name servers you'll get inconsistent resolving results, such as Google public DNS and many other resolvers not being able to lookup records for your domain. Beware before you use DO name servers in production!!

Reply
Woet July 25, 2015

No.

Reply
Have another answer? Share your knowledge.

Related Questions