DNSSEC

DNSSEC signs DNS answers so that a resolver can verify they came from the zone owner rather than from somebody on the network path. The chain runs downward: the parent zone publishes a DS record that commits to your zone's key, your zone publishes the key and signatures over its records, and a validating resolver checks each link back to the root.

Whether to sign is a real decision rather than an obvious yes. Signed and correct is better than unsigned. **Signed and broken is far worse than unsigned**, because a validating resolver treats a failed signature as an attack and returns SERVFAIL rather than the record — the domain does not degrade, it disappears, for the substantial fraction of the internet behind validating resolvers.

Almost all real DNSSEC outages are key management: a key rolled in the zone without the DS being updated at the registrar, signatures allowed to expire, or a DNS provider migration done without unsigning first.

If you are turning it on, use a provider that manages signing and key rollover for you and that can push DS updates to the registry automatically. Hand-managed DNSSEC is a standing commitment to a task that fails loudly at a time of its own choosing.

If you are moving DNS providers on a signed domain, unsign first: remove the DS at the registrar, wait for its TTL to expire everywhere, then migrate, then re-sign. Transferring a signed zone between providers without that step is one of the more reliable ways to take a domain off the internet.

Monitor expiry. RRSIG records have a validity window, and a signer that stops running takes the domain down when the last signature expires rather than at the moment it fails.