---
title: How to configure DNSSEC for an internal domain name
description: Learn how to configure DNSSEC for your internal domains using Scaleway's Domains and DNS service. Enable, edit, or deactivate DNSSEC to enhance security and authentication for your domains.
tags: domain dns dnssec internal-domain
dates:
  validation: 2025-06-11
  posted: 2022-10-31
---
import Requirements from '@macros/iam/requirements.mdx'

import image from './assets/scaleway-domain-dnssec.webp'


DNSSEC uses digital signatures based on public key cryptography to strengthen DNS authentication. You can enable or disable DNSSEC for each of your internal domain names.

This page shows you how to enable DNSSEC for your Domains and DNS internal domains only. You can also [enable DNSSEC using the API](https://www.scaleway.com/en/developers/api/domains-and-dns/registrar-api/#path-domains-update-domain-dnssec).

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An internal domain name managed with [Scaleway Domains and DNS](https://www.scaleway.com/en/domains-and-dns/)

## How to activate DNSSEC

1. Click **Domains and DNS** in the **Domains & Web Hosting** section of the [Scaleway console](https://console.scaleway.com) side menu. The Domains and DNS dashboard displays with a list of your domains.
2. Click the **Internal domains** tab. The list of your internal domains displays.
3. Click the domain name you want to configure.
4. Click **Activate** under **DNSSEC** in the domain information section.
    <Lightbox image={image} alt="" />

DNSSEC will be active in a matter of minutes.

## How to edit or deactivate DNSSEC

1. Click **Domains and DNS** in the **Domains & Web Hosting** section of the [Scaleway console](https://console.scaleway.com) side menu. The Domains and DNS dashboard displays with a list of your domains.
2. Click the **Internal domains** tab. The list of your internal domains displays.
3. Click the domain name you want to configure.
4. Click **Deactivate** under **DNSSEC** in the domain information section.

DNSSEC deactivation can take up to 48 hours to fully propagate.