Signing DNS responses.
WHAT IT DOES
Cryptographically signs DNS records so a resolver can verify they were not altered in transit.
It prevents an attacker substituting false answers.
WHETHER YOU NEED IT
Most small business sites do not. It protects against an attack that is uncommon at that scale.
Some sectors and some registries encourage or require it.
WHAT IT INVOLVES
Signing the zone at your DNS provider Publishing a DS record at the registry, through your registrar Keeping the two in step
THE RISK
If the signatures and the DS record disagree, resolvers that validate refuse to answer at all.
The domain becomes unreachable, not merely unverified.
That is a more complete failure than most DNS problems.
WHEN IT BREAKS
Changing DNS providers without updating the DS record Transferring the domain without disabling it first A key rollover going wrong
BEFORE ENABLING IT
Understand how to disable it. You will need that eventually.
BEFORE A TRANSFER OR PROVIDER CHANGE
Disable it, complete the move, and re-enable afterwards.
IF YOUR DOMAIN SUDDENLY FAILS ENTIRELY
Check whether DNSSEC is enabled and mismatched.
