Domains
Enabling DNSSEC for Your Domain
DNSSEC signs your DNS zone cryptographically so that resolvers can prove an answer really came from you, and Kapsule can turn it on for any domain whose DNS we host.
Without DNSSEC, a DNS answer is just an unsigned packet, and an attacker who can inject a forged response into a resolver's cache can send your visitors to their server while your browser bar still shows your domain. DNSSEC closes that by chaining a signature from your zone up to the registry. This guide covers turning it on, publishing the DS record, reading each status, repairing a broken chain, and the one ordering rule that matters when you turn it off.
Before You Start
The DNSSEC card only appears when the domain's DNS zone is hosted on Kapsule nameservers. If you cannot see it on the Security tab, your domain is answering from someone else's DNS.
Kapsule's nameservers, all four:
ns1.kapsulecloud.com
ns2.kapsulecloud.com
ns3.kapsuledns.com
ns4.kapsuledns.com
Give all four, every time. The two different top-level domains are deliberate: a problem in one parent zone cannot take out every one of our nameservers at once. See Nameservers for how to point a domain at them.
Enabling DNSSEC
- Sign in to KPanel and click Domains in the left sidebar.
- Click the domain you want to sign.
- Open the Security tab. The DNSSEC card sits at the top, above Privacy and Lock.
- Read the current status on the card: Disabled, Pending or Active.
- Click Enable DNSSEC.
KPanel confirms with "DNSSEC enabled. Add the DS record to your registrar to activate."
Signing your zone is only half the job. Until a matching DS record exists in the parent zone at the registry, resolvers have no way to know your zone is signed, and nothing validates. The next section is not optional.
Publishing the DS Record
The DS (Delegation Signer) record is the fingerprint of your signing key, held one level up in the domain hierarchy. It is what turns a signed zone into a validated one.
If the Domain Is Registered at Kapsule
Nothing to do. Kapsule submits the DS record to the registry for you and keeps it current. The card says so directly: "Active, managed automatically. We publish and renew the DS record at the registry for you."
If you want to see the values anyway, click View technical details.
If the Domain Is Registered Elsewhere
You have to carry the DS record across by hand. Kapsule signs the zone; only your registrar can put the DS record in the parent.
- On the DNSSEC card, expand the DS Record: add to your registrar panel.
- Copy all three values:
| Field | What it is |
|---|---|
| Key tag | A short numeric identifier for the signing key |
| Algorithm | The signing algorithm number |
| Digest type | The hash type used for the digest |
- Sign in to your registrar and find its DNSSEC or DS Records section. Wording varies, but it is almost always under domain security settings.
- Paste the values in exactly as shown and save.
A DS record that does not match the key actually signing your zone is worse than no DS record at all. Validating resolvers will treat every answer for your domain as forged and refuse to resolve it, which takes your website and your email offline for a large slice of the internet. Copy the values, do not retype them, and confirm the status reaches Active afterwards.
Reading the Status
| Status | What it means | What to do |
|---|---|---|
| Disabled | The zone is not signed. | Click Enable DNSSEC if you want it. |
| Pending | Keys are generated and the zone is being signed, or the DS record has not been seen in the parent yet. | Wait. If you are at an external registrar, publish the DS record now. |
| Active | The zone is signed and the chain of trust is complete. | Nothing. This is the goal. |
Checking It From the Outside
Do not take the panel's word for it. Verify from the public record:
- Open Domains, then WHOIS Lookup in KPanel.
- Enter your domain and click Look up.
- Read the DNSSEC row. It shows Signed or Unsigned based on what the registry actually publishes.
Signed there, plus Active in the panel, means the chain is genuinely complete.
Repairing DNSSEC
If the status is stuck on Pending, or an external check reports a broken chain, the DNSSEC card offers Repair DNSSEC. The confirmation explains exactly what it does: "Kapsule will re-sign your DNS zone and re-publish the DS record at your registrar. This is safe and reversible."
Confirm and you get "DNSSEC repair queued. The status will update shortly." Reload the card after a minute or two.
Reach for Repair before you reach for Disable. Repair re-establishes the chain without a window where your zone is unsigned, whereas disabling and re-enabling means unwinding the DS record and building the whole chain again from scratch.
Disabling DNSSEC
Turning DNSSEC off is genuinely safe, as long as you do the two steps in the right order. Doing them in the wrong order takes your domain off the internet.
REMOVE THE DS RECORD AT YOUR REGISTRAR FIRST, and wait for it to clear from the parent zone. Only then disable DNSSEC here.
If you disable signing while the DS record is still published, every validating resolver will see a domain that claims to be signed but produces no valid signatures, and will refuse to answer for it. Your site and your email go dark for anyone behind a validating resolver, which today includes most large public resolvers and many ISPs. Nothing in your own configuration will look broken.
The correct sequence:
- At your registrar, delete the DS record. If Kapsule is your registrar, ask us to withdraw it rather than doing anything in the panel first.
- Confirm it has actually cleared from the parent. Query the authoritative parent nameserver for the DS record and wait until it genuinely returns nothing. Do not trust a cached answer from a public resolver: a caching resolver can keep serving the old DS record long after the registry has dropped it, and acting on that stale answer is exactly the trap this warning exists for.
- Wait out the parent zone's TTL on top of that.
- Only then, in KPanel, open the domain's Security tab and click Disable on the DNSSEC card. You get "DNSSEC disabled."
When DNSSEC Is Worth It
Turn it on for anything where somebody has a reason to impersonate you: online stores, anything handling logins or payments, professional services domains, and any domain that sends email you care about being trusted.
It costs you nothing on Kapsule DNS, and once the DS record is in place there is nothing to maintain, especially on a domain registered with us where the record is published and renewed for you.
DNSSEC proves that a DNS answer was not tampered with. It does not encrypt your DNS lookups, it does not replace TLS on your website, and it does not authenticate your email on its own. It sits alongside those. For email authentication, see SPF, DKIM and DMARC Explained.
Troubleshooting
There is no DNSSEC card on the Security tab. The domain's DNS is not hosted on Kapsule nameservers. Move the zone to Kapsule DNS first: see Nameservers.
The status has been Pending for hours. On an external registrar, the DS record has probably not been published, or was published with a wrong value. Compare the three values in the panel against what your registrar shows, character by character. Then use Repair DNSSEC.
My site went down right after I changed something DNSSEC-related. This is the DS mismatch failure. Restore the DS record at the registrar to match what Kapsule publishes, or re-enable DNSSEC in KPanel so the zone is signed again, then use Repair DNSSEC. Recovery is bounded by the parent zone's TTL.
Request failed. The card could not reach the DNS cluster. Reload and retry, and if it keeps failing, open a support ticket with your domain name.
I am about to transfer this domain away. Deal with DNSSEC before the transfer, not during it. See Transferring Your Domain to Another Registrar.
Related reading: DNS Basics, Nameservers, and Registering and Managing .nz Domains.