DNSSEC (DNS Security Extensions) adds digital signatures to your domain's DNS records. Resolvers that check DNSSEC can then confirm that an answer really came from your domain's DNS and wasn't tampered with on the way, which protects against attacks such as DNS spoofing and cache poisoning. DNSSEC doesn't encrypt anything; it only proves the answers are genuine.
How it works
The service that runs your domain's DNS signs your records with a private key and publishes the matching public key. A DS record, held by the registry for your domain's extension (for example .com), links to that key. This builds a chain of trust from the root of the internet down to your domain. If a signature doesn't check out, the resolver rejects the answer.
Using DNSSEC with GUDHOST
DNSSEC is turned on or off where your domain's DNS is managed, usually at your registrar. You don't need to do anything special for GUDHOST: adding or changing the A records for your website works the same with DNSSEC on, because your DNS provider signs the new records automatically.
Take care in one situation. If you move your nameservers to another DNS service, turn DNSSEC off first (or set it up again with the new service) and let the change complete. Otherwise the old DS record no longer matches, and resolvers that check DNSSEC treat your domain as broken, so your website and email stop working for many visitors.
If your domain stopped working right after a nameserver change and DNSSEC was on, check with your registrar, or contact support and we'll help you work out what to fix.