DNS4 min de lecture
Should I enable DNSSEC on my .lu, .be or .eu domain?
What DNSSEC protects and what it does not, the one way it takes a domain offline, how to switch it on at the three registries, and when to leave it off.
Cet article n’est pas encore traduit ; la version anglaise est affichée.
Yes, if your DNS host signs the zone for you and handles key rollovers on its own. No, if you would be managing keys by hand on one server. The three registries, DNS-LU for .lu, DNS Belgium for .be and EURid for .eu, all accept DS records, so the registry is not the obstacle. What decides it is your DNS host and how much maintenance you are willing to do.
What DNSSEC does
DNS answers are not signed by default. A resolver asking where example.lu is has to trust whatever comes back, and a forged answer, planted in the resolver's cache or injected on the path, sends everyone using that resolver to the wrong server. DNSSEC adds signatures to the records and a chain of trust from the root down. The root vouches for .lu, .lu vouches for your zone through a DS record, and your zone's keys vouch for each record. A validating resolver (most of the big public ones, and most ISP resolvers today) rejects an answer whose signature does not check out.
DNSSEC proves that the record is the one the zone owner published. It does not encrypt anything, hide your records or replace TLS. Two things depend on it: DANE for mail, where a sending server checks your mail server's certificate through DNS, and any real trust in records like CAA and TLSA.
How it takes a domain offline
A resolver that cannot validate your zone does not fall back to the unsigned answer. It returns SERVFAIL, and for everyone behind that resolver your domain no longer exists. The usual way this happens is not an attack but a move between DNS providers:
You move DNS to another provider, the new provider has different keys (or none), and the old DS record is still at the registry.
From that moment every validating resolver sees a DS that matches no key in the zone and refuses the whole zone, web and mail included. The fix is to remove or replace the DS at the registrar, and it only takes effect once the old DS has expired from caches. So the rule is: remove the DS before you change DNS host, wait a day, then move. The other cause, rarer, is expired signatures, which only happens when a zone is signed by hand and nobody re-signs it.
Switching it on, step by step
- Sign the zone at your DNS host.In most panels this is a single switch. If you are given a choice of algorithm, take 13 (ECDSA P-256 with SHA-256); the keys and answers are small and every resolver supports it.
- Get the DS recordfrom the DNS host: a key tag, an algorithm number, a digest type and a digest. Some hosts show it as a DNSKEY instead; the registrar panel usually accepts either.
- Enter the DS at the registrar, which passes it to the registry. For .lu, .be and .eu this is done in the registrar's domain panel; if the registrar has no DNSSEC field, consider moving the domain to one that has.
- Wait, then verify.The parent publishes the DS within minutes to hours, and resolvers pick it up as caches expire. Run DNSSEC check and look for the DS at the parent, the DNSKEY in the zone, a match between the two and the AD flag from a validating resolver. Whois for .lu, .be and .eu shows whether the registry already has keys on file.
- Note the rollover policyof your DNS host. Hosts that roll keys automatically either keep the DS stable (they roll only the zone-signing key, which the DS does not cover) or publish CDS/CDNSKEY records that the registry can read. Ask which, so you know whether you will ever have to touch the DS again.
When to leave it off
- Your DNS runs on a single server you maintain yourself, signing is not automated, and you would rather not learn key management now. An unsigned zone is reachable, a badly signed one is not.
- You are about to move DNS hosts. Move first, sign afterwards.
- Your registrar cannot take a DS record. Change registrar first.
When it is worth doing today
- Your DNS host signs and rolls keys automatically. Then it costs you ten minutes and one DS record.
- You want DANE for your mail server, or want CAA and MTA-STS records that a resolver can trust.
- The domain carries anything where a redirected visitor would be expensive: a client portal, a mail domain, a payment page.
The matching tools: DNSSEC check for the chain, nameserver check for the servers behind it, and DANE / TLSA check once mail is on the list.
NovaNode · 21.10.2026