Check ID: zone_dnssec_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for DNSSEC configuration by checking if it is enabled to cryptographically sign DNS responses and protect against DNS spoofing and cache poisoning attacks.

​
Risk

Without DNSSEC, DNS responses can be spoofed or modified by attackers.
  • Confidentiality: users can be redirected to malicious sites that harvest credentials
  • Integrity: DNS hijacking enables man-in-the-middle attacks and content modification
  • Availability: cache poisoning can cause denial of service by directing traffic to non-existent servers

​
Recommendation

Enable DNSSEC and ensure DS records are properly configured at your domain registrar.
  • DNSSEC provides cryptographic authenticity for DNS responses
  • After enabling in Cloudflare, you must add the DS record at your registrar
  • Use online DNSSEC validators to verify correct configuration

​
Remediation

# Enable DNSSEC for the zone
resource "cloudflare_zone_dnssec" "<example_resource_name>" {
  zone_id = "<ZONE_ID>" # Critical: enables cryptographic signing of DNS responses
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_dnssec_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks