This article provides the step-by-step procedure for system administrators or clients to delegate and configure Domain Name System Security Extensions (DNSSEC) directly within the native cPanel interface. Enabling DNSSEC adds cryptographic signatures to your DNS records, preventing DNS spoofing and ensuring visitors reach your authentic website.
Objective
To initialize DNSSEC cryptographic zone signing within cPanel and configure the recommended Key-Signing Key (KSK) or Common Signing Key (CSK) settings.
Prerequisites
Before proceeding, ensure the following requirements are met:
-
The domain name must be actively pointed to our cPanel hosting environment
- nsa.myownserver.net
- nsb.myownserver.net
- nsc.myownserver.net
-
You must have valid login credentials for the specific client cPanel account.
-
The domain's DNS zone must be hosted locally on the cPanel server.
Step-by-Step Instructions
Phase 1: Access the Domain Zone Editor
To configure DNS records, you must first navigate to the zone management interface:
-
Log into your cPanel dashboard.
-
Scroll down to the Domains section.
-
Click on Zone Editor.
-
Locate your target domain name in the primary table.
Phase 2: Initialize Cryptographic Zone Signing
Once inside the Zone Editor, you will need to generate the cryptographic keys required for DNSSEC:
-
Click the DNSSEC button inline with the chosen domain.
-
In the DNSSEC management interface, click the blue Create Key button.
-
A confirmation modal will appear; select the Custom configuration option.
Phase 3: Apply the Recommended Configuration
To ensure maximum compatibility and security, configure the custom key generation using our infrastructure standards:
-
Key Setup: Select Simple (Creates a CSK). This generates a combined Common Signing Key to streamline zone administration.
-
Algorithm: Select ECDSA Curve P-256 with SHA-256 (Algorithm 13). This is the industry-recommended, highly secure, and lightweight algorithm.
-
Status: Select Active to ensure the key is applied immediately upon generation.
-
Click Create Key to generate the cryptographic pair.
The system will now display your unique Key Tag, Algorithm, Digest Type, and Digest (DS records).
Phase 4: Enable DNSSEC at the Registry
Generating the keys on your cPanel account is only the first half of the process. To complete the security chain, the keys must be registered with the top-level domain (TLD) registry.
To enable DNSSEC at the registry level, please open a support ticket with our team and provide the following exact details generated from Phase 1-3:
-
Key Tag: A unique 5-digit integer identifier assigned to your key pair (e.g., 24953).
-
Algorithm: The signing algorithm utilized by the host. We highly recommend and typically use 13 (ECDSAP256SHA256).
-
Digest Type: The hashing function applied to the key metadata. As per our infrastructure policy, you must choose SHA-256 (Algorithm 2).
-
Digest: The long, alphanumeric cryptographic fingerprint string that represents your public key.
Our support team will apply these records to your domain registration at the registry level to activate full DNSSEC protection.
Verification
Once our support team confirms that the DS records have been submitted to the registry, you can verify that DNSSEC is operating correctly:
-
Visit an external DNSSEC validation tool, such as the Verisign DNSSEC Analyzer or dnsviz.net.
-
Enter your domain name and run the test.
-
Verify that a secure, unbroken chain of trust is established from the root zone down to your domain's authoritative name servers.
