Protect my domain with DNSSEC

What it is

DNSSEC adds a cryptographic signature to your DNS zone. It prevents a third party from hijacking your domain by faking its DNS answers (spoofing, cache poisoning): visitors are guaranteed to reach your real site and not a fraudulent copy.

How it works

When DNSSEC is enabled, your 1SWISS1 nameservers sign every answer with a private key. We then publish a fingerprint of that key (a DS record) at the domain's registry. Internet resolvers check this fingerprint before trusting the answers: this is the "chain of trust".

• Requirement: your domain must use our nameservers (ns05.1swiss1.com and ns06.1swiss1.com). Otherwise the protection does not apply.

Step by step

1. Go to DNS Management and open your domain's zone.
2. Open the DNSSEC tab.
3. Click Enable: the key is generated and the DS fingerprint is published automatically at the registry.
4. Allow up to about one hour for the protection to become fully effective (the time for the information to propagate).

Frequently asked questions

How do I disable DNSSEC? In the same tab, click Disable: the fingerprint is removed from the registry.

I am going to transfer my domain elsewhere. Disable DNSSEC before the outgoing transfer, otherwise resolution may break during the change.

My nameservers are not yet those of 1SWISS1. First point the domain to our nameservers, then enable DNSSEC.

See also: Manage my domain's DNS.