Enable DNSSEC on a cPanel Server

7 min read

DNSSEC (Domain Name System Security Extensions) signs your DNS records so resolvers can check that answers really came from your nameservers and weren’t forged on the way. Without it, an attacker who can tamper with DNS responses can send your visitors to the wrong server.

Setting it up takes two steps: you sign the domain’s DNS zone on the server, then you publish a DS record at your domain registrar. DNSSEC only works once both are in place.

Which Path to Follow link

The steps depend on the access you have: cPanel on a shared plan, or WHM as a server admin.

If you’re on a GoZen Host shared hosting plan and just want DNSSEC on your domain, the cPanel path is all you need.

Enable DNSSEC from cPanel link

This is the simpler path. If your hosting provider has enabled DNSSEC for your account, you can turn it on yourself from cPanel.

What You’ll Need First link

• A cPanel hosting account with GoZen Host (or any host running cPanel 98+)
• Your domain must use the server’s nameservers (not Cloudflare or an external DNS provider)

Step 1 - Generate DNSSEC Keys in cPanel link

1. Log into your cPanel account.
2. Go to Domains → Zone Editor.
3. Find your domain in the list.
4. Click the DNSSEC button next to it (it’s in the same row as the A Record, CNAME, MX, and Manage buttons).
5. Click Create Key, then click Create in the confirmation popup.

cPanel generates the signing keys and signs your DNS zone. After creation, the DS Records screen shows the values you’ll need:

  Key Tag:      12345
Algorithm:    13 (ECDSAP256SHA256)
Digest Type:  2 (SHA-256)
Digest:       A1B2C3D4E5F6...
  

Copy these values somewhere safe for the next step.

Step 2 - Add the DS Record at Your Registrar link

The DS (Delegation Signer) record tells the parent zone (such as .com) which key signs your zone, which links your zone into the chain of trust. You add it at your domain registrar, not in cPanel.

If your domain is registered with GoZen Host:

1. Log into the GoZen Host Client Area
2. Go to Domains → My Domains
3. Click the domain name
4. Look for DNSSEC Management or DS Records
5. Enter the Key Tag, Algorithm, Digest Type, and Digest from Step 1.
6. Save

If your domain is at another registrar (Namecheap, GoDaddy, Porkbun, etc.):

Log into your registrar’s dashboard, find the DNSSEC or DS record settings for your domain, and enter the same four values. The field names are nearly always the same; only the screens differ.

Step 3 - Verify It Works link

Wait 15-30 minutes, then scan your domain with the GoZen DNS Inspector. It checks your DNS records and DNSSEC status in one scan and shows whether DNSSEC is active.

For a deeper look at the chain of trust:

• DNSSEC Analyzer (Verisign) - visual chain-of-trust validator
• DNSViz - detailed graphical map of the trust chain

Enable DNSSEC from WHM link

This part is for server administrators with root or reseller access to WHM, usually on a VPS, dedicated server, or reseller plan.

What You’ll Need First link

• Root or reseller access to WHM
• PowerDNS as your nameserver (DNSSEC is not supported with BIND in cPanel)
• Your domain must use the server’s own nameservers (not Cloudflare, not your registrar’s DNS)
• Access to the domain registrar’s control panel (to add the DS record)

Step 1 - Make Sure DNSSEC Is Available link

Before generating keys, confirm that DNSSEC is enabled for your cPanel users:

1. Log into WHM as root.
2. Go to Packages → Feature Manager.
3. Edit the feature list assigned to your hosting packages.
4. Make sure Manage DNSSEC is checked, then save.

This lets cPanel users manage DNSSEC from their own Zone Editor. If you skip it, only WHM admins can manage DNSSEC.

Step 2 - Generate DNSSEC Keys link

1. In WHM, go to DNS Functions → DNS Zone Manager.
2. Find the domain you want to sign.
3. Click the DNSSEC button next to it.
4. Click Create Key.

Once the keys are created, click View DS Records to see the values you’ll need:

  Key Tag:      12345
Algorithm:    13 (ECDSAP256SHA256)
Digest Type:  2 (SHA-256)
Digest:       A1B2C3D4E5F6...
  

Copy the Key Tag, Algorithm, Digest Type, and Digest values for the next step.

Step 3 - Add the DS Record at Your Registrar link

Add the Key Tag, Algorithm, Digest Type, and Digest from WHM at your registrar, as described in Step 2 under the cPanel instructions above. Until the DS record is published, the signed zone isn’t validated.

Some registrars ask for the DNSKEY record instead of a DS record. If yours does, go back to DNS Zone Manager → DNSSEC for the domain and copy the DNSKEY value from there.

Step 4 - Verify DNSSEC Is Working link

Wait 15-30 minutes, then check the domain with the GoZen DNS Inspector.

From the command line:

  dig +dnssec yourdomain.com A
  

Look for the ad flag (Authenticated Data) in the response header. It means the resolver validated the answer. For more detailed trust-chain checks, use the DNSSEC Analyzer (Verisign) or DNSViz.

Managing DNSSEC Keys link

Key Rotation link

cPanel doesn’t rotate DNSSEC keys automatically, and most sites never need to. If you do rotate a key:

1. Create the new key in WHM (or cPanel Zone Editor).
2. Publish the new DS record at your registrar.
3. Wait for the old DS record’s TTL to pass (24-48 hours is safe).
4. Only then, remove the old key.

Don’t remove the old key until the new DS record has fully propagated. If you do, the chain of trust breaks and validating resolvers such as Google Public DNS and Cloudflare DNS stop resolving your domain.

Disabling DNSSEC link

To turn DNSSEC off safely (for example, before moving to a new DNS provider), whether you set it up from cPanel or WHM:

1. First, remove the DS record at your registrar.
2. Wait 24-48 hours for the old DS record to expire from DNS caches.
3. Then, remove the DNSSEC keys in cPanel or WHM.

Troubleshooting link

What’s Next? link

• Managing DNS Records - understand the records DNSSEC is protecting
• DNS Propagation Explained - how long changes take to go live
• SSL Certificates - encrypting the traffic once visitors reach your server