DNSSEC for a .al domain

What DNSSEC is

When someone opens yourname.al, their computer asks DNS servers for the site's address. In classic DNS, the answer is accepted without any proof that it comes from the right source. That opens the door to attacks where someone injects fake answers into a DNS server's cache and sends visitors to a different server.

DNSSEC, short for Domain Name System Security Extensions, adds cryptographic signatures to DNS records. The server validating the answer checks the signature and, if it does not match, discards the answer. That way the visitor is not silently sent to a forged address.

DNSSEC does not encrypt traffic and does not replace an SSL certificate. It only guarantees that the DNS answer is the one published by the domain owner.

How the chain of trust works

DNSSEC relies on a chain that starts at the internet's root zone, passes through the extension's zone and reaches your domain. Each link vouches for the next.

• Zone keys (DNSKEY) — your DNS provider signs your domain's records with private keys and publishes the public keys in the zone.
• Signatures (RRSIG) — each set of records gets its own signature, which is renewed periodically.
• The DS record — a fingerprint of your key that the registrar submits to the extension's registry. This record links your domain into the chain of trust.

yourname.al.  DS  12345 13 2 (long hexadecimal fingerprint)

The example above is illustrative only. Real values come from the provider managing the DNS zone and must be copied exactly.

The risk: a wrong keyset stops the domain

This is the point to understand before enabling it. Once the DS record is published at the registry, validating servers expect your zone to be signed with the matching key. If it is not, they do not simply treat the answer as insecure, they reject it entirely.

For visitors using those servers, the domain stops working: the site does not open and email is not delivered, even though the hosting is running normally. Typical situations:

• The DS record contains a typo or belongs to an old key.
• You move the nameservers to another provider without first disabling DNSSEC or updating the DS.
• The DNS provider rolls its keys, but the DS at the registry is not updated.
• Signatures expire because the zone is no longer re-signed.

The practical rule: before any nameserver change, disable DNSSEC and wait for the change to propagate; enable it again only once the new provider has signed the zone.

How to enable it for your .al domain

DNSSEC support depends on the provider managing the DNS zone and on what the registry offers for the extension. For that reason, we recommend doing it with the help of support rather than with values copied from various sources.

1. Confirm who manages the domain's nameservers: UpFlare's free DNS or your hosting provider.
2. Open a support ticket with the full domain name and ask for DNSSEC to be enabled.
3. If the zone is managed by another provider, get the DS record details from them and send them in the ticket.
4. After activation, check with a DNSSEC testing tool that the chain is valid and that the site opens normally.

After any change, propagation can take a few hours, up to 24–48 hours. Do not make other nameserver changes during that time.

Is it worth it for your site?

DNSSEC makes the most sense for domains where trust in the address is critical: institutions, financial services, online stores and any domain used for business email. For a simple brochure site the benefit is smaller, but still real.

If you enable it, treat it as part of maintenance: document who manages the zone, tell support before migrations and keep the domain renewed. For the DNS basics, see the DNS and nameservers guide.

Frequently asked questions