Every time someone visits your website or sends you an email, their computer asks the DNS: “what’s the address of this domain?”. DNSSEC makes sure the answer is the right one.
The problem: forged DNS answers
DNS was designed when the internet was a small, trusted network, and it has no built-in checks: whoever receives an answer has no way of knowing whether it is genuine. That opens the door to attacks such as cache poisoning, where an attacker plants false answers in DNS resolvers’ caches. The result: people typing your domain can end up on a cloned website, or emails meant for you can be diverted.
The solution: digital signatures
DNSSEC adds a digital signature to your domain’s DNS answers. The resolver receiving the answer checks the signature and, if it doesn’t match, discards the answer.
Trust works as a chain: the internet’s root zone vouches for the .eu zone, which vouches for your domain. That’s why DNSSEC has to be enabled both on the domain’s DNS servers and at the registry, and it’s the registrar that links the two.
What it protects, and what it doesn’t
DNSSEC guarantees that the address returned by DNS is authentic. It doesn’t encrypt traffic (that’s HTTPS’s job) and it doesn’t protect against a compromised account at your registrar. It’s an extra layer, not a replacement for other security measures.
Does it slow the website down?
No. Signature checks happen in DNS resolvers and are very light. Visitors notice no difference.
How to turn it on with WeRegister
The .eu registry supports DNSSEC. If you use WeRegister’s DNS, you turn it on from the panel without configuring keys by hand: zone signing and publication at EURid are handled for you.
See what you can configure on the DNS and DNSSEC management page.