Do you actually need DNSSEC? A 5-minute decision and setup guide for Australian small businesses

98% of Australian small business domains run no DNSSEC, the single most universal gap at this tier (Red Bridge Cyber SMB Posture Baseline, June 2026). That is not a statistic about negligence. It is a statistic about defaults. Every Australian registrar leaves DNSSEC off when you sign up, and most never tell you it exists.

Whether you should change that depends on what your business carries through DNS. Here is both sides, honestly. If you want the full primer first - what DNSSEC is, why every registrar ships it off, and how to check your own domain in two minutes - start with why 98% of Australian small businesses have no DNSSEC. This page picks up where that one leaves off: the decision, and the five-minute fix.

What DNSSEC actually does

When someone visits your website, their device asks a DNS resolver "where is yourbusiness.com.au?". The resolver returns an IP address. Without DNSSEC, there is no cryptographic proof that the answer came from the real authority, your registrar, rather than from an attacker who poisoned the resolver's cache, intercepted the query, or compromised an upstream link.

DNSSEC fixes that. Your registrar signs every DNS record with a private key. A small piece of public information, the Delegation Signer (DS) record, sits at the auDA registry layer. Resolvers walk that signature chain and verify that the answer they got is the answer your registrar published. If anyone has tampered with the record in transit, the signature fails and the resolver throws the answer away.

It is not exotic technology. The standard is from 2005, the cryptography is solid, and the deployment is one click at most modern registrars.

Why almost nobody has it

We have asked. The answers cluster into three groups.

The first is registrar UX. Older Australian registrars bury DNSSEC in a sub-menu of an advanced DNS panel most owners never open. Some make you phone support to enable it. A few charge for it as a "premium" service. None surface it during signup.

The second is the symptomless failure mode. When DNSSEC is missing, nothing visibly breaks. Your site loads, your mail works, and no customer rings to say "I think your DNS got hijacked." The risk is asymmetric, almost never realised but serious when it is, and the human habit with asymmetric risk is to ignore it.

The third is the lack of a forcing function. No Australian regulation requires DNSSEC for businesses outside the federal government. The ACSC's Essential Eight does not mandate it. The OAIC does not flag its absence in privacy assessments. Your insurer does not ask.

What a DNSSEC checker would tell you

Type your domain into MXToolbox's DNSSEC checker. You get one of two answers. If DNSSEC is off, you see "No DNSKEY records found" with a red flag and the line "The domain is not secured with DNSSEC." That is what 98% of Australian small businesses in our baseline see. If DNSSEC is on, the same tool shows the DNSKEY records and the DS record, both validated.

The tool tells you the state. It does not tell you what to do about it. That gap is exactly the role this page fills.

Should you actually fix it?

For most Australian small businesses, the practical risk of running without DNSSEC is low. Cache-poisoning attacks are real but rarely aimed at a 12-person business in Brisbane. The honest cost-benefit sits closer to "a small upgrade with negligible downside" than to "an urgent fix."

The picture flips in three cases. First, if you handle sensitive data such as health records, legal client matters, or financial records, the exposure to a man-in-the-middle attack on an authenticated session becomes real, and DNSSEC is one of the cheaper mitigations available. Second, if your customers include regulated organisations, those customers may start asking. We have seen three NDIS providers ask their software vendor about DNSSEC in the last quarter. Third, if you are a registrar, a hosting provider, or any business whose customers trust you with their own domains, your DNSSEC posture is part of your brand promise.

The defensible default, if you are not in one of those three cases, is to turn it on, because it is free and one-click. The cost is small, the asymmetric upside is real, and the risk of having it on and not needing it is zero.

How to enable it (five minutes at most registrars)

The exact path differs by registrar. The shape is the same.

At Cloudflare: DNS tab, Settings, enable DNSSEC, then copy the DS record values into your registrar's DS field.

At Crazy Domains: Domain management, DNSSEC tab, enable. They publish the DS record to auDA automatically.

At VentraIP: My Services, manage domain, DNSSEC, enable. Same automatic DS publication.

At GoDaddy: DNS management, DNSSEC, turn on. Note that GoDaddy's default implementation has historically used longer key-rotation windows than other registrars. It is still better than nothing.

After enabling, wait 24 to 48 hours and re-run the DNSSEC check. The answer should flip to green.

What we don't do

We are not a penetration testing firm, and we will not tell you DNSSEC is the difference between safe and unsafe. We are not a registrar, so we cannot enable it for you. We scan the public-facing posture and report it in plain English. If you want to understand the difference, compare us to penetration testing or a security consultancy.

If you want a continuous view of whether DNSSEC, CAA, DMARC and the rest of the DNS-layer posture is correct on your domain, start a scan.

Common questions

Does my small business need DNSSEC? For most small businesses the practical risk of running without it is low, so it is a "nice upgrade", not an emergency. It becomes genuinely worth prioritising if you handle sensitive data (health, legal, financial), your customers are regulated organisations who may ask, or other businesses trust you with their domains. Even otherwise, turning it on is sensible: it is free and one-click at most registrars.

How do I check if my domain has DNSSEC? Run your domain through MXToolbox's DNSSEC checker. "No DNSKEY records found" with a red flag means DNSSEC is off, which is what 98% of Australian small business domains show. If it is on, you will see validated DNSKEY and DS records.

Published by the Red Bridge Cyber team. Sources: Red Bridge Cyber SMB Posture Baseline, June 2026; auDA; ACSC; MXToolbox DNSSEC test.