How to enable DNSSEC
DNSSEC signs your DNS records so an attacker cannot forge them in transit and send visitors to a fake site. At most registrars it is a single switch in the control panel.
If DNS is hosted somewhere other than your registrar (Cloudflare, for example), enable it at the DNS host first and copy the DS record to the registrar. The wrong order can take the site offline.
How to fix it
DNS registrar
Where: your domain registrar's control panel
Enable DNSSEC (one toggle at most registrars — Cloudflare, GoDaddy, Google Domains all support it).
DNSSEC cryptographically signs your DNS so it can't be tampered with in transit.
How to confirm: The registrar shows a 'DNSSEC: active' status once propagated.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free