How to Enable DNSSEC With Cloudflare Easily 2026

After logging into your Cloudflare account and selecting a domain, you land on its Overview page — traffic charts for unique visitors, total requests, and cache percentage, plus a DNS panel on the right confirming DNS Setup is Full. This is also where you'd notice if your domain isn't yet using Cloudflare's nameservers, which DNSSEC depends on, since the DNS Setup status needs to read Full rather than Partial before signing will work correctly.

From the left sidebar, expand DNS and click Settings rather than Records — this is a distinct sub-page from the records list, dedicated to zone-level configuration. Scrolling down, you'll see a Cloudflare Nameservers card listing your two assigned NS values, then directly below it a DNSSEC card with a short explanation — "DNSSEC uses a cryptographic signature of published DNS records to protect your domain against forged DNS answers" — and a single Enable DNSSEC button. Further down the same page are related but separate toggles for Multi-signer DNSSEC and Multi-provider DNS, which most single-provider setups can ignore.

Clicking Enable DNSSEC immediately opens a DS Record modal instructing you to copy the details below and add them to your domain registrar. The modal lists several values: the full DS Record string in registrar-ready format, a separate Digest field, a Digest Type field (SHA256 in this case), an Algorithm field (13), a Public Key, a Key Tag, and Flags (257, marked KSK for Key Signing Key). Every field has its own copy icon, and most registrars will ask for the Key Tag, Algorithm, Digest Type, and Digest as four separate fields rather than the single combined DS Record string, so read your registrar's form carefully before pasting.

DNSSEC only works once the DS record exists in two places: Cloudflare, where it already is, and your registrar's parent zone, which is what actually tells the rest of the internet to trust your signed records. Log into whichever registrar manages your domain — GoDaddy, Namecheap, and Porkbun all have a dedicated DNSSEC section — and paste in the Key Tag, Algorithm, Digest Type, and Digest values exactly as Cloudflare generated them. A single mistyped digit in the Digest field will break validation entirely rather than just degrading it, so copy each value with its copy icon instead of retyping by hand.

Back in the DS Record modal, clicking Confirm tells Cloudflare you've completed the registrar-side step, which changes the DNSSEC card's status from pending to active. This confirmation doesn't verify the registrar actually has the correct values — it just acknowledges you've done your part — so a typo at the registrar can still leave your domain in a broken, half-signed state even after you click Confirm here.

Once both sides show DNSSEC as enabled, use an external tool like DNSViz to independently confirm the chain of trust is intact from the root down to your domain. This step matters because Cloudflare's own dashboard can only tell you what it sees on its end — an independent validator checks the whole path, including the registrar's parent zone, which is exactly where a bad copy-paste would show up as a broken link in the chain.