How to manage DNSSEC security keys on your domain

The Domain Name System Security Extensions (DNSSEC) is a set of specifications that extend the DNS protocol by adding cryptographic authentication for responses received from authoritative DNS servers. Its goal is to defend against techniques that hackers use to direct computers to rogue websites and servers.

Summary of how it works: A DNS resolver uses a name server's public key to check that the records it provides were signed with its corresponding private key. It then makes sure that the public key presented by the server in the first place is legitimate by looking at another record that contains a signature of that key and compares it with a record from the parent zone -- called a DS record -- to validate it. This establishes a chain of trust between parent and child zones.

Here's how to set it up in CPANEL