# What does enabling DNSSEC change for my domain?

Canonical URL: https://help.iagenify.com/faqs/domains/what-does-enabling-dnssec-change-for-my-domain

[← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)

HELP CENTER · FAQ Domains 2 min read
# What does enabling DNSSEC change for my domain?
DNSSEC adds signed DNS data that resolvers can validate. Enabling it requires coordinating the DNS zone's signing state with the DS record at the registrar.
IaGenify
Domains

## Understand the two sides of the change
DNSSEC depends on matching information in the DNS zone and at the registrar. The zone publishes signing records, while the registrar holds a DS value that points to the signing key. A mismatch can cause validating resolvers to reject answers, making the domain appear unreachable even when ordinary DNS records look correct.
Enabling DNSSEC in a control panel may provide the DS value to publish; it does not necessarily place that value at the registrar for you. Follow the instructions for the domain's registrar and verify the DS data there. Do not copy a DS value from a different domain or an earlier zone configuration.
## Use a safe order when changing settings
When enabling, first confirm the authoritative zone is active and signed, then publish the matching DS data with the registrar and verify it. When disabling, remove the DS record at the registrar before turning off signing in the zone. Reversing that order can leave a DS record pointing to a zone that no longer signs.
After a change, check the public DNSSEC status and test name resolution from a validating resolver. If the domain stops resolving, compare the DS record and current zone signing details before making more changes. DNSSEC protects the integrity of DNS answers; it does not encrypt website traffic or replace HTTPS. [← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)