DNSSEC
DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring requests are not routed to a spoofed domain.
For additional background on DNSSEC, visit the Cloudflare Learning Center ↗.
If you are onboarding an existing domain to Cloudflare, make sure DNSSEC is disabled at your registrar (where you purchased your domain name). Otherwise, your domain will experience connectivity errors when you change your nameservers.
Provider-specific instructions
This is not an exhaustive list of how to update DS records in other providers, but the following links may be helpful:
Why you have to disable DNSSEC
When your domain has DNSSEC enabled ↗, your DNS provider digitally signs all your DNS records. This action prevents anyone else from issuing false DNS records on your behalf and redirecting traffic intended for your domain.
However, having a single set of signed records also prevents Cloudflare from issuing new DNS records on your behalf (which is part of using Cloudflare for your authoritative nameservers). So if you change your nameservers without disabling DNSSEC, DNSSEC will prevent Cloudflare’s DNS records from resolving properly.
DNSSECを有効にすると、Cloudflareはあなたのゾーンに署名し、公開署名鍵を公開し、DSレコードを生成します。
- Log in to the Cloudflare dashboard ↗ and select your account and domain.
- Go to DNS > Settings.
- For DNSSEC, click Enable DNSSEC.
- In the dialog, you have access to several necessary values to help you create a DS record at your registrar. Once you close the dialog, you can access this information by clicking DS record on the DNSSEC card.
Add the DS record to your registrar. If Algorithm 13 - Cloudflare’s preferred cipher choice - is not listed by your registrar, it may also be called ECDSA Curve P-256 with SHA-256.
Provider-specific instructions
This is not an exhaustive list of how to update DS records in other providers, but the following links may be helpful:
CloudflareをセカンダリDNSプロバイダーとして使用しており、セカンダリゾーンでDNSSECを設定したい場合は、設定に応じて3つのオプションがあります。
サブドメインゾーンでDNSSECを設定したい場合は、サブドメインDNSSECを参照してください。
レジストラがCloudflareの推奨暗号選択（アルゴリズム13）でDNSSECをサポートしていない場合、いくつかのオプションがあります：
- レジストラに連絡して、最新の暗号化によるDNSSECを依頼する。
- アルゴリズム13でDNSSECをサポートしている別のレジストラにドメインを移管する。
- レジストラの不遵守を理由にICANNに苦情を申し立てる ↗。
トップレベルドメインがアルゴリズム13（ECDSA Curve P-256 with SHA-256としても知られる）でDNSSECをサポートしていない場合は、そのトップレベルドメインに連絡してください ↗。