DNSSEC on WordPress.com

DNSSEC (Domain Name System Security Extensions) adds an extra level of security to your domain. It ensures DNS records served publicly are authentic and reduces the risk of DNS-related attacks. This guide explains how to enable and use DNSSEC with your domain on WordPress.com.

In this guide

1. Enable DNSSEC For Your Domain
2. DNSSEC For Connected Domains
   1. Check the DNSSEC Status of Your Domain
   2. DNSSEC with Name Servers
   3. DNSSEC with A Records

Enable DNSSEC For Your Domain

DNSSEC is supported for all domains registered on WordPress.com from 2017 onwards, as long as the domain uses WordPress.com name servers.

To activate DNSSEC for your WordPress.com domain, take these steps:

1. Visit your Sites page at https://wordpress.com/sites.
2. On the left, click on “Domains“ to view a list of all your domains.
3. Click on the domain for which you want to enable DNSSEC.
4. On the domain settings page, click on the DNSSEC panel to expand it.
5. Click on the toggle button labeled “DNSSEC disabled” to enable DNSSEC. With DNSSEC enabled, the panel will show the DNSKEY and Delegation Signer (DS) records.
   • Conversely, click on the “DNSSEC enabled” toggle to disable DNSSEC.

DNSSEC For Connected Domains

WordPress.com cannot enable DNSSEC on domains registered with another registrar. However, you can transfer your domain registration to WordPress.com and enable DNSSEC using the setting above.

When connecting a domain to WordPress.com from another registrar, you may need to take additional steps if your registrar has enabled DNSSEC.

Check the DNSSEC Status of Your Domain

If your domain is registered with another provider, follow these steps to check the DNSSEC status of your domain:

1. Visit Google’s Public DNS Checker.
2. Type your domain in the search field.
3. Look for the line in the output that starts with "AD":, which stands for “Authenticated Data.”
   • If DNSSEC is active and validated, you will see a line in the output of "AD": true,.
   • If DNSSEC is not active, you will see "AD": false,.

DNSSEC with Name Servers

To use name servers (recommended method) to connect your domain to WordPress.com, you must disable DNSSEC before you update your DNS to point to WordPress.com.

Your domain’s free SSL will be provisioned only after you disable DNSSEC using these steps:

1. Log into your domain registrar or existing DNS management system.
2. Locate and turn off DNSSEC; the steps vary, so contact your DNS provider for assistance if needed.
3. Complete the domain connection process on WordPress.com as normal.

If you have already updated your name servers to point to WordPress.com, you need to change them back to your previous DNS provider to turn DNSSEC off and then switch them back to WordPress.com.

All DNS changes can take up to 48 hours to propagate fully. Allow time for the changes to take effect.

DNSSEC with A Records

If you use A Records (alternate method) to connect your domain to WordPress.com, you do not need to turn off DNSSEC to connect your domain. The domain’s free SSL will be provisioned normally.