Enable DNSSEC
DNS · about 15 min
In plain words
DNSSEC adds a digital signature to your DNS answers, so resolvers can detect forged records pointing visitors elsewhere.
What can go wrong
Low for most sites, but without it DNS spoofing/cache-poisoning attacks are easier.
How to fix it
Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.
Cloudflare
DNS → Settings → DNSSEC → Enable
Then copy the DS record into your registrar (unless the domain is registered at Cloudflare).Other DNS hosts
1. Turn on DNSSEC / zone signing at your DNS host.
2. Copy the DS record it gives you.
3. Paste it at your registrar (domain settings → DNSSEC).Before you change anything: If you move DNS providers later, disable DNSSEC (remove the DS record at the registrar) first, or the domain can go offline.
Check that it worked
Re-run the ProbeHunt check (it looks for DNSKEY records).