How DNSSEC protection works with Squarespace Domains.

DNSSEC protection is automatically included with all Squarespace-managed domains. DNSSEC protects your domain against attacks, like DNS spoofing or redirecting your domain to a malicious site. This guide explains how DNSSEC works and where to find resources on how to add extra DNSSEC protection to your domain.

What is DNSSEC and how does it work with Squarespace domains?

Domain Name System Security Extensions, or DNSSEC, is an advanced form of domain security. It verifies the DNS settings for visitors using public and private keys, to ensure data from the domain wasn’t altered in transit to the visitor. These keys are automatically stored in your DNS records as DS or DNSKEY records.

To learn more about adding DS records or DNSKEY records, visit DNS records for security.

Enabling DNSSEC settings

The most common scenario where you'd need to enable DNSSEC is if you remove custom nameservers and third-party DNSSEC to your domain. Otherwise, DNSSEC is automatically enabled for Squarespace Domains LLC domains with .com or .net TLDs. You don't need to do anything to set it up.

To enable DNSSEC:

1. Open your domains dashboard.
2. Click the domain you're editing.
3. Click DNS, then click DNSSEC.
4. Switch on the toggle beside DNS Security Extensions.
5. A confirmation window will appear. Click Confirm. This removes the DNSSEC information from the domain and registry.

Adding third-party DNSSEC protection

If your Squarespace Domains LLC has a TLD other than .com or .net, you don’t have automatic DNSSEC protection from Squarespace. Instead, you can purchase third-party DNSSEC protection from a provider, like Cloudflare, and add it to your DNS settings using the steps below. You can add third-party DNSSEC protection to your DNS settings using DS records or DNSKEY records.

Tip: In most cases, your domain provider provides DNSSEC. Contact your domain provider to see if you need to add DNSSEC to your domain.

To add third-party DNSSEC protection to your domain:

1. Open your domains dashboard.
2. Click the domain you're editing.
3. Click DNS, then click DNSSEC.
4. Enter information from your third-party DNSSEC provider in the fields, then click Send to registry. If your domain is registered to Squarespace Domains, LLC and is using custom nameservers, these fields show in the DNSSEC window:
   • Key tag
   • Algorithm
   • Digest type
   • Digest
5. When the information is successfully submitted, a “DNSSEC signed” message will display.

Tip: If you add third-party DNSSEC protection to your domain, keep in mind:

• You can only add one DNSSEC record to your domain.
• Contact your third-party DNSSEC provider for the values needed to add a DNSSEC record.

Disabling DNSSEC settings

If you have more complex security needs, you may need to disable DNSSEC.

To disable DNSSEC:

1. Open your domains dashboard.
2. Click the domain you're editing.
3. Click DNS, then click DNSSEC.
4. Switch off the DNS Security Extensions toggle.
5. A confirmation window will appear. Click Confirm. This removes the DNSSEC information from the domain and registry.

Troubleshooting

Here are some issues you may encounter with DNSSEC and how to resolve them.

Error message: Records are incompatible with DNSSEC

If you're adding an advanced DNS record to your DNS settings, you might see this error message in the DNSSEC panel.

To resolve this:

1. Disable DNSSEC.
2. Add the DNS record again.

Error message: DNSSEC validation failure

This error can occur if you’re having trouble sending or receiving email while using custom nameservers.

To resolve this issue:

1. Reset your nameservers back to the Squarespace defaults.
2. Enable DNSSEC.