Agent Wranglers

Hosting and network Optional

Sign your DNS

Sign the DNS zone with DNSSEC, so answers can't be forged. Then add the DS record where you bought the domain.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Turn on signing at your DNS host. Publish the DS record it gives you at the registrar.

Example

dig +dnssec example.com A
# Look for "flags: qr rd ra ad" in the answer

How to check

A validating resolver returns AD. DNSViz shows a complete chain.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/dnssec.