Safety
DNS Hygiene vs DNSSEC and Registrar Lock
June 13, 2023
DNS hygiene vs DNSSEC and registrar lock is a stack, not a single checkbox. Hygiene is knowing who your nameservers are, removing stale records, and using a registrar you can actually recover. Registrar transfer lock stops a class of domain-theft tickets. DNSSEC cryptographically authenticates DNS answers when resolvers check it. A public site can look fine on HTTPS and still be one unlocked registrar account away from a quiet hijack. RoastMyOpsec looks up public NS records for inventory. It does not attempt transfers, zone edits, or DNSSEC forging.
The practical difference
Nameserver inventory is operational: which company answers for the zone, and whether leftover NS still point at a forgotten provider. Registrar lock is an account control: disable unauthorized transfers. DNSSEC is a protocol control: signed records so a poisoned cache is harder to believe.
You can have DNSSEC and still lose the domain if the registrar login is email-only and unlocked. You can lock the registrar and still have dangling CNAMEs.
How to choose what to do first
Recover the registrar account (unique password, MFA). Turn on transfer lock. Inventory NS and leftover CNAMEs. Enable DNSSEC where the DNS host and TLD support it without breaking mail. Then keep a change log so marketing subdomains do not rot.
| Control | Job | Failure mode | Takeaway |
|---|---|---|---|
| Know your NS | Accountable DNS operator | Orphaned hosts, two providers fighting | Start with a written inventory |
| Registrar lock | Block surprise transfers | Unlocked domain + phished email | Do this before DNSSEC debates |
| DNSSEC | Authenticate DNS data | Mis-signed zone = outage | Enable when the host makes it boring |
| Stale records | Remove ghosts | Dangling CNAME / old MX | Pairs with the takeover guide |
When DNSSEC waits
If the DNS panel cannot roll keys safely, or mail breaks on a bad DS record, fix operations first. An unlocked registrar with perfect DNSSEC is still a weak front door.
Preview and staging zones deserve the same lock story as production, or they become the reset path.
Common mistakes
The first mistake is a shared registrar login in a spreadsheet.
The second mistake is enabling DNSSEC and never monitoring validation failures.
The third mistake is changing NS without updating DS records.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is DNSSEC required for a marketing site?
- It is strongly recommended where supported, but it is not a substitute for registrar MFA and transfer lock. Hygiene first, then signing.
- Does RoastMyOpsec prove DNSSEC is valid?
- No. It inventories public nameservers. Confirm DNSSEC in your DNS host and with a resolver you trust.
- What should I do before transferring DNS providers?
- Lower TTLs, copy records, switch NS, watch mail and the website, then remove the old provider. Keep registrar lock on until you intend a transfer.