Issue with enabling DNSSEC
My domain registar doesn't support adding DS records, is there still any way I can enable DNSSEC from Cloudfare?
1 Reply
not enabling in the sense you'd benefit from it. DNSSEC is a chain, each layer above provides the trust information for the layer below, and the root (.) layer is hardcoded/trusted. So you could enable it in Cloudflare and I believe CF even without verification starts serving DNSKEY records, but it'd be meaningless as your registrar wouldn't be telling the tld what to trust.
For example, if your website was example.com, you'd have something like
. (root) <- Trusted, serving DS record for com
.com <- Trusted, serves NSEC, saying there's nothing to verify
example.com <- Not verified via dnssec, doesn't matter if Cloudflare serves DNSKEY records and signed responses, there's nothing to verify them with