DNSSEC Explained: Should a Small Business Turn It On?

What DNSSEC is, in plain English

When someone types your domain, their device asks a DNS resolver (usually run by their ISP or a service like Google or Cloudflare) for your website's address. As ICANN's DNSSEC explainer puts it, the DNS was originally designed so that a resolver cannot easily detect a forged response. An attacker who can inject a fake answer can redirect users to a site they control.

DNSSEC fixes that by signing your DNS records. ICANN describes two features it adds: data origin authentication (the resolver can verify the answer really came from your zone) and data integrity protection (the answer was not changed in transit). If the signature does not check out, a validating resolver discards the answer and returns an error instead of the fake address.

The trust comes from a chain: your zone is signed with your key, and a fingerprint of that key, the DS (Delegation Signer) record, is published by the parent zone, such as .sg or .com. That DS record is the piece that links your domain to the chain, and it is the piece that causes outages when it is wrong.

What DNSSEC protects against, and what it does not

SGNIC's DNSSEC FAQ says DNSSEC is intended to protect against man-in-the-middle DNS spoofing and cache poisoning, and that it is not a complete solution for all security threats. It is meant to complement SSL certificates and two-factor authentication.

For most small businesses, a stolen registrar or DNS login is a bigger risk than DNS forgery. Put MFA on your registrar and DNS host first; consider a registry lock for high-value domains, which SGNIC also offers for .sg.

How to enable DNSSEC for a .sg domain

SGNIC sets out three steps for .sg domains. Your DNS host and your registrar both need to support DNSSEC; if either does not, it cannot be enabled.

1. 1

   Check your DNS host and registrar both support DNSSEC

   Your DNS host is where your records live (Cloudflare, your web host, your registrar's DNS). Your registrar is where you pay for the domain. They may be the same company.

2. 2

   Ask the DNS host to sign the zone

   Many hosts have a one-click Enable DNSSEC button. The host then gives you a DS record: a key tag, algorithm, digest type and digest.

3. 3

   Submit the DS record through your registrar

   Paste the DS values into the registrar's DNSSEC settings. The registrar submits them to SGNIC, which publishes the DS record.

4. 4

   Check it worked

   SGNIC says the WHOIS result for your .sg domain shows DNSSEC as Signed once enabled, or Unsigned if not. You can also use an online DNSSEC checker.

On Cloudflare, the DNSSEC docs describe the same pattern: click Enable DNSSEC in the DNS settings, then add the DS record at your registrar. Cloudflare's preferred algorithm is 13 (ECDSA Curve P-256 with SHA-256); if your registrar does not list it, you may need to ask them or move registrars. New to DNS records? Our DNS records guide explains the basics.

The big risk: moving DNS hosts or registrars

SGNIC also warns that DNSSEC can be complex, and that technical complexities can arise when owners change DNS hosting providers. A safe move looks like this:

1. Remove the DS record at the registrar.
2. Wait for the DS record's TTL to expire; Cloudflare notes this varies by top-level domain, so check it with a DNS lookup tool.
3. Move the nameservers to the new DNS host and check everything resolves.
4. Enable DNSSEC at the new host and add the new DS record at the registrar.

Cloudflare also documents a zero-downtime path using multi-signer DNSSEC, if your current provider supports it. If you are also changing registrar, our .sg domain transfer guide covers the transfer steps, and our Cloudflare set-up guide covers moving DNS to Cloudflare.

Should a small business turn DNSSEC on?

SGNIC's view is that DNSSEC benefits all registrants, and especially e-commerce sites or those handling sensitive or personal information. The practical answer depends on your set-up:

Leaving DNSSEC off does not break anything: SGNIC confirms unsigned domains still resolve normally for DNSSEC-aware resolvers. Turning it on is low effort if your providers handle key rollovers automatically, which most managed DNS hosts do.

Do it yourself or get help?

If your DNS and domain are with providers that offer one-click DNSSEC, you can switch it on yourself in 15 minutes and check the WHOIS shows Signed the next day.

Our Domain & DNS Setup (S$99) puts the domain in your name, sets the website and email records, checks SSL and sets up auto-renew. Ask us to include DNSSEC where your providers support it, and we will record the steps for any future move.