# What is DNSSEC, and should I enable it for my domain?

Canonical URL: https://help.iagenify.com/faqs/domains/what-is-dnssec-and-should-i-enable-it-for-my-domain

[← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)

HELP CENTER · FAQ Domains 2 min read
# What is DNSSEC, and should I enable it for my domain?
DNSSEC adds cryptographic signatures to DNS data so validating resolvers can detect certain forged or altered responses. It can improve DNS integrity, but a mismatched or stale configuration can make a domain fail to resolve, so use a supported, coordinated setup.
IaGenify
Domains

## Understand the signing chain
DNSSEC validation relies on a chain from the parent zone's DS record to the child zone's DNSKEY and signed records. The registrar, DNS host, and any intermediary must publish matching information for the chain to validate.
If you change providers, rotate keys, or move a domain, confirm who manages signing and how the DS record will be updated. An old DS record at the parent paired with a different child key can cause validating resolvers to return failure.
## Enable and maintain it carefully
Check that your DNS provider supports DNSSEC for the zone and documents key rollover and registrar updates. Follow that provider's sequence because control planes and timing differ.
After activation, use DNSSEC-aware validation tools and query multiple resolvers, then repeat the check after provider or registrar changes. Keep a recovery plan for correcting stale DS data; do not remove signing records casually while the chain is active. [← Back to Domains FAQs](https://help.iagenify.com/faqs/domains)