DNSSEC Configuration

1) Turn on DNSSEC

• Enable DNSSEC at your DNS provider (e.g., Cloudflare)
• Copy DS record and add at your domain registrar

2) Verify

https://dnssec-analyzer.verisignlabs.com/
dig +dnssec sitesignal.app

3) Monitor

• Track key rollovers and DS changes
• Set alerts in SiteSignal when DS/A/AAAA change