Overview
DNSSEC (Domain Name System Security Extensions) adds an essential layer of authentication to your domain's DNS. By digitally signing your DNS records, it ensures that your visitors are directed to your legitimate website rather than a malicious or spoofed domain.
For generic top-level domains (gTLDs), DNSSEC must be manually configured by adding Delegation Signer (DS) records provided by your DNS host. This creates a secure link between your DNS provider and the domain registrar, preventing DNS hijacking.
Step by Step
Case 1: Using our DNS Management Service
If your domain is pointed to our nameservers (e.g., ns1.ns.ly, ns2.ns.ly):
- Log in to your Client Area account
- Navigate to Domains > My Domains, and select your .LY domain you wish to manage.
- From the left-hand sidebar, select DNS Manager.
- Click the Enable DNSSEC button on top.
- Once the status changes to DNSSEC Enabled, click on Manage button next to it.
- Copy the provided DS Record values (Key Tag, Algorithm, Digest Type, and Digest).
- Return to the domain management page (step 2), and from the left-hand sidebar, select DNSSEC Settings.
- Click the green Add A New DNSSEC Record button.
- Enter the following values generated by your DNS Provider:
- Keytag
- Algorithm
- Digest Type
- Digest
- Click Add Record.
Case 2: Using External Nameservers
If you are using another DNS provider for your domain (e.g., cPanel, Cloudflare), you must manually bridge the security gap between your provider and the registrar.
- Log in to your DNS Service Provider’s dashboard (the place where you manage your DNS records).
- Locate their DNSSEC section and click Enable or Generate.
- Copy the provided DS Record values (Key Tag, Algorithm, Digest Type, and Digest).
- Now, log in to your Client Area account with us.
- Navigate to Domains > My Domains and select the domain you wish to manage.
- From the left-hand sidebar, click on DNSSEC Settings.
- To add a new record, click the green Add A New DNSSEC Record button.
- Enter the following values generated by your DNS Provider:
- Keytag
- Algorithm
- Digest Type
- Digest
- Click Save.
Verification (Optional)
After configuring or removing records, allow up to 2 hours for propagation. You can verify your domain's status using an external tool like DNSSEC Analyzer to ensure the “Chain of Trust” is correctly established or removed.
Disabling DNSSEC
⚠️ Important: Order of Operations
To prevent your website from going offline (SERVFAIL error), you must follow this specific sequence:
- Delete the DS Record in the Client Area: Click the delete button in your dashboard. This immediately updates our database, but the global Registry may take 1–2 hours to reflect the change.
- Wait 1 Hour: Allow time for the Registry to stop telling resolvers to look for a digital signature.
- Disable DNSSEC at your DNS Provider: Only turn off the signing at your DNS host (e.g., Cloudflare) after the waiting period is over.
Note: If you disable it at your provider first while the DS record still exists at the registrar, your site will fail to load globally because resolvers will look for a signature that is no longer there.
