DNSSEC for Squarespace domains

false

DNSSEC for Squarespace domains

Last updated September 11, 2026 19:23

How DNSSEC protection works with Squarespace Domains.

DNSSEC protection is automatically enabled for all Squarespace-managed domains with a TLD that supports DNSSEC. DNSSEC protects your domain against attacks, like DNS spoofing or redirecting your domain to a malicious site. This guide explains how DNSSEC works and where to find resources on how to add extra DNSSEC protection to your domain.

Also try: DNS records for security.

Watch a video

What is DNSSEC and how does it work with Squarespace domains?

Domain Name System Security Extensions, or DNSSEC, is an advanced form of domain security. It uses a series of public and private keys to ensure data from the domain wasn’t altered as your visitors load the site. These keys are automatically stored in your DNS records as DS or DNSKEY records.

If your domain is registered with Squarespace we add DNSSEC to your domain. When you register your domain, it may take a few hours for DNSSEC to start working. This is a normal part of the registration process and you don't need to take any action.

Technical details

Our DNS zone providers are Cloud DNS and NS1. They use a 13 - Elliptical Curve Algorithm (ECDSA P-256) when assigning DNSSEC to your domain.

Disabling DNSSEC settings

DNSSEC is automatically disabled if you switch to using custom nameservers for your domain. If you don't use custom nameservers but have other complex security needs, you may need to manually disable DNSSEC.

To disable DNSSEC:

  1. Open your domains dashboard.
  2. Click the domain you're editing.
  3. Click DNS, then click DNSSEC.
  4. Switch off the DNS Security Extensions toggle.

Note: If you don't see the DNS Security Extensions toggle, follow our troubleshooting steps.

  1. A confirmation window will appear. Click Confirm. This removes the DNSSEC information from the domain and registry.

Adding third-party DNSSEC protection

If you'd prefer to add third-party DNSSEC protection to your domain instead of using Squarespace's built-in option, you can purchase third-party DNSSEC protection from a provider, like Cloudflare, and add it to your DNS settings using the steps below. You can add third-party DNSSEC protection to your DNS settings using DS records or DNSKEY records.

Tip: In most cases, your domain provider provides DNSSEC. Contact your domain provider to see if you need to add DNSSEC to your domain.

To add third-party DNSSEC protection to your domain:

  1. Open your domains dashboard.
  2. Click the domain you're editing.
  3. Click DNS, then click DNSSEC and Add record.
  4. If your domain is registered to Squarespace Domains, LLC and is using custom nameservers, you can add DS records with these fields in the DNSSEC window:
  5. Key tag
  6. Algorithm
  7. Digest type
  8. Digest
  9. Enter information from your third-party DNSSEC provider in the fields, then click Save.

Tip: If you add third-party DNSSEC protection to your domain, keep in mind:

  • You can only add one DNSSEC record to your domain.
  • Contact your third-party DNSSEC provider for the values needed to add a DNSSEC record.

Re-enabling DNSSEC settings

DNSSEC is automatically enabled on any Squarespace Domains LLC domains with a TLD that supports DNSSEC. To manually enable DNSSEC after disabling:

  1. Open your domains dashboard.
  2. Click the domain you're editing.
  3. Click DNS, then click DNSSEC.
  4. Switch the toggle beside DNS Security Extensions on.

If you change back to Squarespace's default nameservers from custom ones, you'll be prompted to re-enable DNSSEC. Click View DNSSEC in the window that appears, then switch on the toggle beside DNS Security Extensions.

Troubleshooting

Here are some issues you may encounter with DNSSEC and how to resolve them.

Error message: Records are incompatible with DNSSEC

If you're adding an advanced DNS record to your DNS settings, you might see this error message in the DNSSEC panel.

To resolve this:

  1. Disable DNSSEC.
  2. Add the DNS record again.

Error message: Unable to update DNSSEC settings. Please try again later.

If you have an ALIAS record in your DNS settings, you may see this error message when trying to enable DNSSEC.

To resolve this:

  1. Delete the ALIAS record.
  2. Enable DNSSEC.

Error message: DNSSEC validation failure

This error can occur if you’re having trouble sending or receiving email while using custom nameservers.

To resolve this issue:

  1. Reset your nameservers back to the Squarespace defaults.
  2. Enable DNSSEC.

Error message: DNSSEC is currently not supported for this domain

You’ll get this error if your domain can't use DNSSEC. This happens for many reasons because of domain registration rules. For example, .us and .au can't use DNSSEC. If your domain doesn't support DNSSEC, your domain still works, and you don't have to take action. Consider other ways to protect your domain using DNS records.

Was this article helpful?

Yes No

30 out of 51 found this helpful

Yes No

DNSSEC for Squarespace domains