---
title: How to Enable DNSSEC for Your Domain
description: This article explains how to secure your domain name using Domain Name System Security Extensions (DNSSEC). Enabling DNSSEC adds a layer of security to your domain by attaching cryptographic signatures to your Domain Name System (DNS) records, protecting your visitors…
url: "https://www.domaincentral.com.au/help/enable-dnssec-for-your-domain/"
updated: "2026-09-11"
category: Domains
---

# How to Enable DNSSEC for Your Domain

This article explains how to secure your domain name using Domain Name System Security Extensions (DNSSEC). Enabling DNSSEC adds a layer of security to your domain by attaching cryptographic signatures to your Domain Name System (DNS) records, protecting your visitors from DNS spoofing and cache poisoning attacks.

### Objective

To enable DNSSEC on a domain zone hosted **on our name servers** and submit the required cryptographic delegation signer (DS) records to the registry.

### Prerequisites

Before you begin, ensure that your domain is configured to use our official name servers:

- **nsw.name-servers.net.au**
- **nsx.name-servers.net.au**
- **nsy.name-servers.net.au**
- **nsz.name-servers.net.au**

### Step-by-Step Instructions

#### Phase 1: Generate the DNSSEC Keys

Follow these steps within your client portal to generate your unique cryptographic keys:

- Log in to your client portal.
- Click on **Domains** >> **Manage DNS** in the main navigation menu.
- Locate the domain zone you wish to secure and click **Edit** next to it.
- In the top-right corner of the zone management screen, click on the **3 dots** icon.
- Select **DNSSEC** from the dropdown menu.
- Click the **Enable DNSSEC** button.

The system will now generate and display your unique **DNS Key** and **Delegation Signer (DS)** records.

> **Security Warning:** The generated DNS cryptographic keys must be kept secure. Do not share these keys with anyone under any circumstances.

#### Phase 2: Enable DNSSEC at the Registry

Generating the keys on our nameservers is only the first half of the process. To complete the security chain, the keys must be registered with the top-level domain (TLD) registry.

To enable DNSSEC at the registry level, please **open a support ticket** with our team and provide the following exact details generated from Phase 1:

- **Key Tag:** A unique 5-digit integer identifier assigned to your key pair (e.g., 24953).
- **Algorithm:** The signing algorithm utilized by the host. We highly recommend and typically use **13** (ECDSAP256SHA256).
- **Digest Type:** The hashing function applied to the key metadata. As per our infrastructure policy, you must choose **SHA-256** (Algorithm 2).
- **Digest:** The long, alphanumeric cryptographic fingerprint string that represents your public key.

Our support team will apply these records to your domain registration at the registry level to activate full DNSSEC protection.

### Verification

Once our support team confirms that the DS records have been submitted to the registry, you can verify that DNSSEC is operating correctly:

- Visit an external DNSSEC validation tool, such as the [Verisign DNSSEC Analyzer](https://www.google.com/search?q=https://dnssec-analyzer-verisign-labs.com/) or [dnsviz.net](https://dnsviz.net/).
- Enter your domain name and run the test.
- Verify that a secure, unbroken chain of trust is established from the root zone down to your domain's authoritative name servers.