When to use this guide
Use this guide when internet.nl/site/ (listed in the Domain & server security checklist ) shows either or both of:
- Domain name not signed (DNSSEC): the DNS zone has no cryptographic signatures
- DS record missing at registrar: the zone may be signed, but the chain of trust is incomplete
Both checks fail together when DNSSEC is not enabled at all, which is the most common situation.
How urgent is this? DNSSEC is a relatively low-risk gap compared to missing DMARC enforcement or MFA. It protects against a specific and sophisticated attack (DNS spoofing/cache poisoning) but does not affect HTTPS, email security, or day-to-day website security. It is required for the Dutch internet.nl standard and is a prerequisite for DANE (an advanced email security layer). Treat this as a "fix when the opportunity arises" issue: not worth migrating your DNS provider for if this is the only reason to do so.
Who does this?
This requires access to two places:
- The DNS hosting provider — to enable DNSSEC signing on the zone
- The domain registrar (where the domain was registered) — to publish the DS record
These may be the same party, or two different parties.
Background: what is DNSSEC?
| Concept | What it does |
|---|---|
| DNSSEC zone signing | Adds cryptographic signatures to all DNS records, so resolvers can verify they haven't been tampered with |
| DS record at registrar | Published at the parent zone (e.g. SIDN for .nl), it completes the chain of trust from the root all the way down to your domain |
| Chain of trust | The full path from root → .nl → yourdomain.nl must be signed at every level for DNSSEC to work end-to-end |
Without DNSSEC, visitors can in theory be silently redirected to malicious servers (DNS spoofing / cache poisoning) even if HTTPS is active. In practice this attack requires significant resources and is rare.
Step 1: Check whether your DNS provider supports DNSSEC
Not all DNS hosting providers support DNSSEC. Before proceeding, check the table below.
✅ Providers that support DNSSEC:
| Provider | Notes |
|---|---|
| Cloudflare | Free, one-click enablement — recommended |
| TransIP | Dutch registrar, widely used for .nl |
| Versio | Dutch, supports DNSSEC |
| Antagonist | Dutch, supports DNSSEC |
| AWS Route 53 | Supported |
| Google Cloud DNS | Supported |
| Azure DNS | Supported |
| GoDaddy | Via Premium DNS plan |
| Namecheap | Supported |
| ClouDNS | Supported |
| deSEC | Free, German non-profit, DNSSEC enabled by default |
❌ Providers that do NOT support DNSSEC:
| Provider | Notes |
|---|---|
| SiteGround | DNSSEC not supported — confirmed in their documentation |
| Hetzner | DNSSEC not supported — confirmed in their documentation |
If your DNS is hosted at SiteGround or Hetzner, you cannot enable DNSSEC without migrating your DNS zone to a different provider. Given the low urgency of DNSSEC (see above), this migration is only worth doing if you have other reasons to switch providers as well.
Step 2: Enable DNSSEC at your DNS hosting provider
Log in to the control panel of your DNS hosting provider and find the DNSSEC section. The exact location varies per provider — search their documentation for "DNSSEC" if you can't find it.
Enable zone signing. The provider will generate the zone keys and sign all DNS records automatically. Once enabled, the provider will show you a DS record containing four values:
- Key Tag
- Algorithm
- Digest Type
- Digest
Copy these — you need them for Step 3.
Step 3: Publish the DS record at your domain registrar
Log in to the registrar where the domain is registered (the party you pay for the domain name itself).
Find the DNSSEC or DS record settings for the domain and enter the four values from Step 2 (Key Tag, Algorithm, Digest Type, Digest).
For .nl domains, the registrar submits this to SIDN (the .nl registry), which completes the chain of trust.
Do not skip this step. Even if the zone is signed in Step 2, the chain of trust is broken without the DS record at the registrar — and internet.nl will still fail the test.
Step 4: Wait for propagation
DNS changes can take up to 48 hours to propagate globally, though for DNSSEC it is typically faster (under an hour for .nl domains once the DS record is submitted).
Step 5: Verification: re-run the test
Verify using internet.nl/site/ — enter the domain and run a new test. Both subtests should now pass:
- ✅ DNSSEC is enabled on the domain's DNS zone
- ✅ DS record is present at the registrar
For a more detailed view of the chain of trust, use DNSViz — enter the domain and check the DNSSEC view. Every node in the chain should show green.