How To Disable Or Enable DNSSEC

This guide explains how to enable DNSSEC and allow the required DS records to be created automatically.

Domain Name System Security Extensions (DNSSEC) adds an extra layer of security to your domain’s DNS records. It helps protect your website visitors from DNS spoofing and cache poisoning attacks by allowing DNS responses to be cryptographically verified before they are trusted.

When DNSSEC is enabled, a chain of trust is created between your domain name and the authoritative DNS servers hosting your DNS records. This chain relies on Delegation Signer (DS) records, which authenticate your domain’s DNSSEC keys.

At Domains.co.za, DS records are managed automatically when DNSSEC is enabled for domains using our authoritative nameservers. This means you do not need to manually create or update DS records.

IMPORTANT:

DNSSEC can only be enabled for domains using the Domains.co.za authoritative nameservers. Enabling DNSSEC while using third-party nameservers may cause your domain to become unreachable because the automatically generated DS records will no longer match your DNS provider.

Domains.co.za authoritative nameservers are:

• ns1.tld-ns.net
• ns2.tld-ns.com
• ns3.tld-ns.net
• ns4.tld-ns.com

Before You Begin

Before enabling DNSSEC, ensure that:

• Your domain is using the Domains.co.za authoritative nameservers.
• Your domain is active and registered with Domains.co.za.
• You have access to your Domains.co.za Customer Portal.
• You understand that enabling DNSSEC while using different nameservers may prevent your domain from resolving correctly.

How to Disable or Enable DNSSEC

Step 1: Login to the Customer Portal.

1. Login to your Domains.co.za Customer Portal.

2. Open the Manage Services drop-down menu.

3. Select Domains.

4. Click Manage next to the domain you wish to configure.

Step 2: Verify Your Nameservers

Before enabling DNSSEC, confirm that your domain is using the following Domains.co.za nameservers:

• ns1.tld-ns.net
• ns2.tld-ns.com
• ns3.tld-ns.net
• ns4.tld-ns.com

If your domain is using different nameservers, do not enable DNSSEC until they have been updated.

Step 3: Enable DNSSEC

1. Locate DNSSEC.
2. If the status displays Disabled, click Enable.
3. Wait for the change to be processed.

Domains.co.za will automatically generate and publish the required DS records for your domain.

Step 4: Verify DNSSEC

After DNSSEC has been enabled:

• Confirm that your website loads correctly.
• Verify that your email services continue to function normally.
• Allow time for DNS changes to propagate across the Internet.

Troubleshooting

• My Domain Is No Longer Reachable: This usually occurs when DNSSEC has been enabled while the domain is using third-party nameservers. Disable DNSSEC or update your domain to use the Domains.co.za nameservers before enabling it again.
• DNSSEC Cannot Be Enabled: Verify that your domain is using the supported Domains.co.za nameservers. DNSSEC cannot be enabled for domains using external DNS providers.
• DNS Changes Have Not Taken Effect: DNSSEC changes may take some time to propagate. Wait for DNS propagation to complete before testing again.
• My Website or Email Is Not Working: Confirm that your domain is using the correct nameservers and that DNSSEC has been enabled successfully. If the issue persists, contact Domains.co.za Support.

Additional Information

• DNSSEC helps protect your domain against DNS spoofing and cache poisoning attacks by validating DNS responses.
• Domains.co.za automatically manages the required DS records when DNSSEC is enabled on supported domains.
• DNSSEC is only supported when your domain uses the Domains.co.za authoritative nameservers.
• Enabling DNSSEC while using third-party nameservers can cause your website, email, and other DNS services to become unreachable.
• You do not need to manually enter DS record values when using the Domains.co.za DNSSEC service.
• DNSSEC protects the integrity of DNS responses but does not encrypt DNS traffic.
• DNS propagation may take some time after enabling DNSSEC before the changes are visible worldwide.
• If you are unsure whether your domain is using the correct nameservers, contact the Domains.co.za Support team before enabling DNSSEC.

Login to Domains.co.za Account

1. Go to the Domains.co.za website Account Login page.

2. Enter your Email and Password and click the Sign In button.

3. You will see the Domains.co.za Dashboard, displaying the Manage Account menu on the left and your Account Information, Account Overview and Open Support Tickets on the right.