How do I enable DNSSEC on a domain?

Question

How do I enable DNSSEC on a domain?

Answer

To enable DNSSEC for a domain:

Note: PowerDNS must be the active/enabled nameserver to use DNSSEC. If a DNS cluster is in use, all cluster members, including the local server, must use PowerDNS. 

1. Log in to cPanel as the user that owns the domain.
2. Select the Zone Editor.
3. Click on the DNSSEC button in the row of the domain you wish to enable DNSSEC on
4. On the right-hand side, click the Create Key button.  A pop-up will appear.
5. Click Create on the pop-up box.  It will be dismissed, and you will see an interface with your DS records.
6. Copy those records to the proper interface in your domain's registrar.  Every registrar is a little different, so we can't provide step-by-step instructions for this process.
   • If you instead need the public key rather than the digest records, navigate back to the DNSSEC page in the Zone Editor. Clicking the View Details arrow on the left edge of the DNSSEC record lets you export your public key.

Additional Resources

Zone Editor (cPanel Docs)

DNSSEC (cPanel Docs)