What Is DNSSEC and Should You Turn It On?
DNSSEC adds signatures to your DNS records so visitors’ computers can confirm the answers really came from your domain and were not tampered with on the way.
What it protects against
Without DNSSEC, an attacker who can tamper with DNS answers could send visitors or email to the wrong server. DNSSEC lets resolvers detect and reject those fake answers.
How to enable it
If your DNS host and registrar are the same company, DNSSEC is often a single switch in the domain settings. If they are different, your DNS host gives you a DS record that you add at your registrar.
What to watch out for
Turn DNSSEC off before moving your domain to a new DNS host, then turn it on again afterwards. A leftover DS record pointing to old keys can make your domain unreachable.