What is DNSSEC and should I enable it?

DNSSEC (Domain Name System Security Extensions) is a set of DNS protocol extensions that adds cryptographic signatures to a domain's DNS records. Its purpose is to guarantee that the DNS answer a visitor receives (your website's IP address, for example) really comes from you and hasn't been tampered with along the way (an attack known as DNS spoofing or cache poisoning).

In short: without DNSSEC, DNS runs on trust; with DNSSEC, every answer can be cryptographically verified.

Enabling DNSSEC requires both the domain's registry (EURid for .eu, RoTLD for .ro) and the DNS provider you use (EUReg or another) to support the feature, with the public keys correctly published at the registry. For most small and medium sites the risk of a DNS spoofing attack is low, but DNSSEC is recommended for domains used for sensitive purposes (banking, institutional) or wherever regulations require it.