Easy Tech TutsHow to Enable DNSSEC With Cloudflare Easily 2026
By Impran M NLast checked against official docs
DNSSEC adds a cryptographic chain of trust to your domain's DNS responses, making it much harder for an attacker to spoof records or poison a resolver's cache. In Cloudflare, turning it on is a single click, but finishing the job means copying a handful of cryptographic values into a completely different system, your domain registrar. This guide covers where DNSSEC lives inside Cloudflare's DNS settings, what the generated DS record contains, and why the registrar step is the part people skip and then can't work out why validation fails.
Before you start
- Your domain already using Cloudflare's nameservers, with DNS Setup showing Full, not Partial
- DNSSEC turned off at your registrar first, if you're migrating a domain that had it enabled with a previous DNS provider
01Open your domain's Overview in Cloudflare
After logging into your Cloudflare account and selecting a domain, you land on its Overview page: traffic charts for unique visitors, total requests and cache percentage, plus a DNS panel confirming DNS Setup is Full. If it reads Partial instead, DNSSEC signing won't work correctly yet, since Cloudflare isn't fully authoritative for the zone.
02Go to DNS Settings and find the DNSSEC card
From the left sidebar, expand DNS and click Settings, not Records; this is a separate sub-page dedicated to zone-level configuration. Scrolling down shows a Cloudflare Nameservers card listing your two assigned NS values, then a DNSSEC card directly below it with a short explanation and a single Enable DNSSEC button. Further down the same page are related but separate toggles for Multi-signer DNSSEC and Multi-provider DNS, which a single-provider setup like this one can ignore.
03Click Enable DNSSEC and review the DS record
Clicking Enable DNSSEC opens a DS Record modal instructing you to copy the details below into your registrar. It lists the full DS Record string in registrar-ready format, plus its parts broken out separately: Digest, Digest Type (SHA-256), Algorithm (13), Public Key, Key Tag, and Flags (257, marked KSK for Key Signing Key).
Algorithm 13 is Cloudflare's preferred cipher; if your registrar's form doesn't list "13", look for its other name, ECDSA Curve P-256 with SHA-256. Most registrars ask for the Key Tag, Algorithm, Digest Type and Digest as four separate fields instead of the single combined string, so read your registrar's form before pasting anything.
04Add the DS record at your domain registrar
DNSSEC only works once the DS record exists in two places: Cloudflare, where it already is, and your registrar's parent zone, which is what tells the rest of the internet to trust your signed records. Log into whichever registrar manages your domain and find its DNSSEC section, then paste in the Key Tag, Algorithm, Digest Type and Digest values exactly as Cloudflare generated them. Use each field's copy icon instead of retyping by hand; a single mistyped digit in the Digest breaks validation outright instead of just degrading it.
05Confirm the record inside Cloudflare
Back in the DS Record modal, clicking Confirm tells Cloudflare you've completed the registrar-side step, which moves the DNSSEC card's status from pending to active. This confirmation doesn't check that the registrar has the correct values; it only acknowledges you've done your part. A typo at the registrar can still leave the domain in a broken, half-signed state after you click Confirm.
06Validate the signed status independently
Once both sides show DNSSEC enabled, use an external tool like DNSViz to confirm the chain of trust from the root down to your domain. Cloudflare's dashboard can only report what it sees on its own end; an independent validator checks the whole path, including the registrar's parent zone, which is exactly where a bad copy-paste would surface as a broken link in the chain.
| Field | Typical value | What it's for |
|---|---|---|
| Digest | A long hex string | The cryptographic hash your registrar stores to verify Cloudflare's signing key |
| Digest Type | SHA-256 | Which hashing algorithm produced the Digest |
| Algorithm | 13 (ECDSA Curve P-256 with SHA-256) | Which cipher Cloudflare used to sign the zone |
| Key Tag | A short numeric ID | Identifies which of Cloudflare's keys the record refers to |
| Flags | 257 (KSK) | Marks this as the Key Signing Key, not a Zone Signing Key |
Most registrar forms want Key Tag, Algorithm, Digest Type and Digest as four separate fields, not the combined DS Record string.
When it doesn't work
My registrar's DNSSEC form doesn't list Algorithm 13
Why: Some registrars label Cloudflare's preferred algorithm by its full cryptographic name instead of the number.
Fix: Look for "ECDSA Curve P-256 with SHA-256" in the algorithm dropdown; it's the same setting as Algorithm 13. If it isn't offered at all, your registrar doesn't support Cloudflare's signing algorithm and DNSSEC can't be completed there.
The domain became unreachable right after switching nameservers to Cloudflare
Why: DNSSEC was already enabled with the previous DNS provider, and its old DS record is still sitting at the registrar pointing to keys that no longer exist.
Fix: Disable DNSSEC at the registrar before or during the nameserver switch, confirm the domain resolves normally on Cloudflare, then follow this guide to re-enable it with Cloudflare's own DS record.
DNSViz or a resolver reports a broken chain of trust after setup
Why: A field was mistyped at the registrar, most often the Digest, or Confirm was clicked in Cloudflare before the registrar's own DNS had propagated the new record.
Fix: Re-copy each field from Cloudflare's DS Record modal using its copy icon instead of retyping, and give the registrar's change a few hours to propagate before validating again.
Frequently asked questions
What does DNSSEC protect against?
It establishes an authenticated chain of trust for DNS responses, which protects against cache poisoning and DNS spoofing attacks that rely on forging DNS answers.
Do I need to enable DNSSEC at both Cloudflare and my registrar?
Yes. Cloudflare generates the signing keys and DS record when you click Enable DNSSEC, but the chain of trust isn't complete until you copy that record's Key Tag, Algorithm, Digest Type and Digest into your registrar's own DNSSEC settings.
How long does it take for DNSSEC to become active after enabling it?
Once the DS record is added at your registrar, activation typically takes anywhere from a few minutes to a couple of hours, depending on propagation and how quickly your registrar processes the change.
What happens if I migrate a domain that already had DNSSEC enabled elsewhere?
Disable DNSSEC at the old provider or the registrar before switching nameservers to Cloudflare. An old DS record left pointing at keys that no longer exist will make the domain unreachable until it's removed.
How can I confirm DNSSEC is fully working after setup?
Use an independent tool like DNSViz to check the full chain of trust from the root down to your domain. It verifies the registrar's side too, not just what Cloudflare's own dashboard reports.
Sources and last check
Click path, field names and screenshots were re-checked against Cloudflare's own DNSSEC documentation in September 2026 and matched what this guide already described. Two things the original version left out were added from that same documentation: the prerequisite to disable DNSSEC at the registrar before migrating a domain that already had it enabled elsewhere, and Algorithm 13's alternate name, ECDSA Curve P-256 with SHA-256, for registrars that don't list it by number.
About the author
Impran M N
I've been hooked on technology for as long as I can remember — especially the new tools and AI apps that seem to land every other week. Easy Tech Tuts is where I write up whatever I've just worked out: I do the task in the real product, record the screen, and turn it into the guide I wish I'd found first.
