I recently configured DNSSEC for one of my domains, and while the process isn’t complicated, the documentation scattered across Namecheap and Cloudflare left me piecing together information from multiple sources.
If you’re running a domain registered with Namecheap but using Cloudflare for DNS management, this guide will walk you through the entire DNSSEC setup process—including the parts that aren’t immediately obvious.
Table of contents
Open Table of contents
What is DNSSEC and Why Should You Care?
DNSSEC (Domain Name System Security Extensions) adds a layer of security to the DNS lookup process by using cryptographic signatures to verify that DNS responses haven’t been tampered with.
Without DNSSEC, when someone types your domain into their browser, the DNS response they receive could theoretically be intercepted and modified by an attacker (a DNS spoofing attack). DNSSEC prevents this by allowing DNS resolvers to verify that the response came from the authoritative source and hasn’t been altered in transit.
Think of it as HTTPS for DNS—it doesn’t encrypt the data, but it does verify its authenticity.
Why enable DNSSEC?
- Security: Protects against DNS cache poisoning and spoofing attacks
- Trust: Assures visitors they’re reaching the real destination, not an imposter
- Compliance: Some security standards and regulations recommend or require DNSSEC
- Best Practice: It’s becoming an expected security baseline for serious projects
If you’re running a business website, handling sensitive data, or just want to follow security best practices, DNSSEC is worth enabling.
The Namecheap + Cloudflare Setup
First, let’s clarify the setup we’re working with:
- Domain Registrar: Namecheap - This is where you purchased your domain
- DNS Provider: Cloudflare - This is where you manage DNS records (A, CNAME, MX, etc.)
You might wonder: “Why use Cloudflare when Namecheap offers DNS?”
Cloudflare provides:
- Better performance (global CDN network)
- DDoS protection
- Advanced caching and optimization
- More robust analytics
- Better DNS management interface
Many developers register domains with Namecheap (competitive pricing, good support) but point nameservers to Cloudflare for DNS management and performance benefits.
For DNSSEC, this means:
- Cloudflare generates and manages the DNSSEC signing keys
- Namecheap needs to know about these keys via DS (Delegation Signer) records
- You configure both services to work together
Step 1: Enable DNSSEC in Cloudflare
Start by enabling DNSSEC in Cloudflare, which will generate the cryptographic keys needed.
- Log into your Cloudflare dashboard
- Select the domain you want to secure
- Navigate to DNS in the left sidebar
- Scroll down to the DNSSEC section (it’s usually at the bottom of the DNS settings page)
- Click “Enable DNSSEC”
Cloudflare will generate DNSSEC keys and present you with DS record information. This is where things get important, don’t close this page yet.
You’ll see information that looks like this:
Key Tag: 12345
Algorithm: 13 (ECDSA Curve P-256 with SHA-256)
Digest Type: 2 (SHA-256)
Digest: a1b2c3d4e5f6...What are these values?
- Key Tag: A short identifier for the DNSSEC key
- Algorithm: The cryptographic algorithm used to sign DNS records
- Digest Type: The hash function used to create the digest
- Digest: The actual cryptographic hash that proves authenticity
These values are what you’ll add to Namecheap. Keep this tab open—you’ll need to copy these values in the next step.
Step 2: Add DS Records to Namecheap
Now we need to tell Namecheap about Cloudflare’s DNSSEC keys by adding DS records at the registrar level.
- Log into your Namecheap account
- Go to Domain List and find your domain
- Click “Manage” next to the domain
- Navigate to the “Advanced DNS” tab
- Scroll down to the “DNSSEC” section
- Activate DNSSEC (or “Manage DNSSEC” if records already exist)
You’ll see a form asking for:
- Key Tag
- Algorithm
- Digest Type
- Digest
Here’s where confusion often happens: Namecheap shows dropdown menus with algorithm and digest type options, but the numbers don’t always match what Cloudflare displays.
Matching the values:
Cloudflare shows: Algorithm: 13 (ECDSA Curve P-256 with SHA-256)
Namecheap dropdown: Look for “13” or “ECDSAP256SHA256”
Cloudflare shows: Digest Type: 2 (SHA-256)
Namecheap dropdown: Look for “2” or “SHA-256”
Copy the exact values from Cloudflare:
- Key Tag: Copy the number exactly
- Algorithm: Select “13” from the dropdown
- Digest Type: Select “2” (SHA-256) from the dropdown
- Digest: Copy the entire digest string (it’s long—make sure you get all of it)
Click “Save Changes”
Step 3: Wait for Propagation
Once you’ve added the DS records to Namecheap, nothing happens immediately.
DNSSEC changes require propagation through the DNS hierarchy:
- Namecheap submits your DS records to the domain’s registry (e.g., Verisign for .com)
- The registry updates the parent zone
- DNS resolvers worldwide pick up the changes
How long does this take?
- Typical propagation time: 1-24 hours
- Conservative estimate: Wait 24-48 hours before troubleshooting
During this time:
- Your site will continue to work normally
- DNSSEC validation will gradually start working as propagation completes
- Some resolvers will validate, others won’t yet—this is normal
Don’t panic if DNSSEC validation doesn’t work immediately. This is expected.
Step 4: Verify DNSSEC is Working
After waiting for propagation, verify that DNSSEC is active and working correctly.
Method 1: Cloudflare Dashboard
The easiest way:
- Go back to your Cloudflare DNS settings
- Find the DNSSEC section
- Look for a status indicator
If everything is working, you should see something like:
- ✅ “DNSSEC is active”
- Or a green checkmark with “DS records detected”
Method 2: Online DNSSEC Validators
Use a third-party tool to verify:
- DNSViz - Visual representation of DNSSEC chain
- Verisign DNSSEC Debugger - Detailed validation report
Enter your domain and run the check. A successful DNSSEC configuration will show:
- Green checkmarks throughout the validation chain
- No errors or warnings about missing DS records
- Valid signatures
Method 3: Command Line (dig)
If you’re comfortable with the terminal:
dig +dnssec yourdomain.comLook for the ad flag (authenticated data) in the response. If DNSSEC is working, you’ll see flags like ad in the response header.
Troubleshooting Common Issues
DS Records Not Detected
Symptom: Cloudflare still shows “DS records not detected” after 24 hours
Possible causes:
- Propagation still in progress (wait longer)
- DS records weren’t saved correctly in Namecheap (double-check they’re there)
- Typo in the digest value (verify exact match with Cloudflare)
Fix: Log back into Namecheap, go to Advanced DNS → DNSSEC, and verify the DS records match exactly what Cloudflare provided.
DNSSEC Validation Failures
Symptom: DNSSEC validators show errors or warnings
Possible causes:
- Algorithm or digest type mismatch
- Incorrect key tag value
- DNSSEC keys rotated in Cloudflare but DS records not updated
Fix: Remove the DS records in Namecheap, wait a few hours, then re-add them with fresh values from Cloudflare.
Site Still Accessible Despite Errors
Important note: If DNSSEC is misconfigured, your site will still be accessible to most users. DNSSEC failures result in warnings or validation errors, but most DNS resolvers will still return the IP address.
However, security-conscious resolvers and tools may refuse to connect, so it’s important to fix any validation errors.
Key Takeaways
DNSSEC with Namecheap and Cloudflare is straightforward, but requires patience:
- Enable DNSSEC in Cloudflare first—this generates the keys
- Copy the DS record values exactly (especially the digest)
- Add DS records to Namecheap’s Advanced DNS settings
- Wait 24-48 hours for full propagation
- Verify using Cloudflare dashboard or external validators
The most common mistakes:
- Not waiting long enough for propagation
- Copying the digest value incorrectly (it’s long—get every character)
- Confusing algorithm numbers with their names
Once it’s set up, DNSSEC runs automatically. Cloudflare handles key rotation and signing, you don’t need to touch it again unless you change DNS providers.
Why This Matters
DNSSEC isn’t a silver bullet for security, but it’s an important layer of defense against DNS-based attacks. For projects handling sensitive data, business domains, or anything where trust matters, enabling DNSSEC is a simple step that meaningfully improves security posture.
If you’re already using Cloudflare for DNS, enabling DNSSEC costs nothing and takes 15 minutes (plus propagation time). It’s one of those “set it and forget it” security improvements that’s absolutely worth doing.
Questions or issues setting up DNSSEC? Reach out at [email protected] or on Twitter, happy to help troubleshoot.
Resources:
- Cloudflare DNSSEC Documentation
- Namecheap DNSSEC Guide
- DNSViz - Visual DNSSEC validation tool