# Enable DNSSEC

DNSSEC digitally signs your DNS so resolvers can detect tampering.

## Steps

1. Open **Domains → [your domain]** and find the **DNSSEC** section.
2. Enable DNSSEC. Orvoro generates the signing keys and shows a **DS record**.
3. Publish the **DS record at your registrar** (if the domain is registered elsewhere). If it's registered with Orvoro and Orvoro-managed, this is handled for you.
4. Allow time for the DS record to propagate; verify status on the same screen.

## Troubleshooting

- **Validation errors after enabling** — a mismatched or missing DS record breaks resolution; remove DNSSEC, then re-add and republish the DS record carefully.
- **Registrar has no DNSSEC field** — some registrars don't support it; you may need Orvoro-managed nameservers.

**Related:** Set your domain's nameservers · Manage DNS records