---
title: "Sign your DNS · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/dnssec
updated: 2026-10-20
licence: "All rights reserved"
---

# Sign your DNS

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Sign the DNS zone with DNSSEC, so answers can't be forged. Then add the DS record where you bought the domain.
- How: Turn on signing at your DNS host. Publish the DS record it gives you at the registrar.
- Check: A validating resolver returns `AD`. DNSViz shows a complete chain.

Example:

```sh
dig +dnssec example.com A
# Look for "flags: qr rd ra ad" in the answer
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/dnssec`.

- Previous: [Choose who may issue your certificates](https://agentwranglers.se/playbook/website/hosting-and-network/caa-records)
- Next: [Host where routes are signed](https://agentwranglers.se/playbook/website/hosting-and-network/rpki)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)