How do I add a DS Record to my registrar?

To finish turning on DNSSEC, you'll have to add one record, called a DS, to your registrar. Here is a guide for how to do this with many popular registrars. (Note that not all TLDs have added DNSSEC support yet. CloudFlare keeps a list of TLDs that are not DNSSEC compatible yet here:

Note that not all registrars have added support yet for DNSSEC with CloudFlare's chosen cipher suite (algorithm 13, also known as "ECDSA Curve P-256 with SHA-256"). Please also note that registrars sometimes support a different set of verification algorithm depending on the TLD. If your registrar does not support DNSSEC, you may transfer your domain to any of the following, or email your registrar and ask them to add DNSSEC support:

How to add your DS record to:

NOTE: Some of the registrars below only support DNSSEC with algorithm 13 for some TLDs.

These registrars do not yet have support for DNSSEC or DNSSEC with algorithm 13:

  • Network Solutions
  • FastDomain
  • 1&1 Internet
  • Wild West Domains
  • Educause
  • OnlineNIC
  • Ascio
  • HiChina
  • Xin Net
  • Webfusion
  • Crazy domains
  • Mailnspace
  • NetEarthOne
  • Hostway
  • InternetX
  • (Not currently supporting third party DNS)
  • WordPress

The support of DNSSEC is evolving constantly. Should you find out this list is inaccurate or out of date, please let us know via a support ticket.


Still not finding what you need?

The Cloudflare team is here to help. 95% of questions can be answered using the search tool, but if you can’t find what you need, submit a support request.

Powered by Zendesk