1

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money.

How can I easily setup DNSSEC for my domain?

  • .money should support DNSSEC. So it's a question of your registrar. For DNSSEC to work you need to deploy a (DS?) record in the parent zone (i.e. .money) and handle all the stuff on your DNS server yourself. For this it is generally recommended to find a DNS provider that will support DNSSEC and pass the DS record via support ticket to the registrar who will likely place it in the parent zone. – SEJPM Mar 4 '16 at 22:21
  • @SEJPM sounds like an answer to me – Neil Smithline Mar 5 '16 at 6:45
5

.money is one of the new top level domains (TLDs), as such it (by itself) should support DNSSEC.

This turns the DNSSEC support into a question of your registrar. As you noted already, it's not supported by default by your registrar and its DNS services.
This leaves you only the option to run your own DNS server with DNSSEC server and by "own" I mean either really your own BIND server (not recommended) or some DNS provider who automatizes DNSSEC for you.

Running DNS yourself however isn't the full solution to deploy DNSSEC. You also need to a) inform your registrar that you don't want to use his DNS servers anymore, but your own (this should be a standard thing) and b) tell the registrar the so called "DS" record. The registrar than needs to put the DS record into the parent zone (i.e. .money), which should be done by a short support ticket along with the DS record.

0

All "new" gTLDs support DNSSEC, this is made mandatory by ICANN contracts to registries.

Now the issue may be with registrars. There are two parts: you need (currently, but we are starting to see solutions like in .DK with Cloudflare doing otherwise) to go through your registrar to make it send to the registry the necessary DS or DNSKEY records. This is basically when you are maintaining the DNS yourselves. The other part is when the registrar is doing the DNS service for you (in which case it still needs to send DNSSEC parameters to the registry, but this becomes hidden to you).

Again, ICANN contracts mandate all registrars to support sending DNSSEC key materials to the registry. However it does not mandade them (as this is in fact totally unrelated to their registration service) to have DNS services that support DNSSEC.

So you will first need to understand in which of the 2 cases you are. And be warned that handling yourself your DNS servers while enabling DNSSEC on them is not a small task/commitment.

In all cases, did you ask your registrar for help? If it is unable or unwilling to help you for a service you pay, it may be a sign you should change where you shop...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.