NITDA makes DNSSEC mandatory in cybersecurity checks for government agencies

The National Information Technology Development Agency (NITDA) has added Domain Name System Security Extensions (DNSSEC) to its cybersecurity assessment criteria for all Ministries, Departments and Agencies (MDAs). The agency also wants government websites on the .gov.ng domain to adopt DNSSEC, which uses digital signatures to verify domain name records and protect against certain cyberattacks.

NITDA Director General Kashifu Inuwa Abdullahi disclosed the policy at a cybersecurity awareness webinar organised by the Nigeria Internet Registration Association (NiRA) through its .ng Academy on Monday. The webinar was part of Cybersecurity Awareness Month and had the theme “Securing Nigeria’s Digital Foundation: DNSSEC, the .ng Domain, and the Future of National Cyber Resilience”.

DNS security becomes part of MDA checks

Abdullahi, who was represented by Oluwasegun Falayan, said NITDA would incorporate DNS security into its cybersecurity assessment framework. He stressed that government institutions must secure their domain names, not just register them.

“So we must lead, we must ensure that every .gov.ng is signed as much as possible, and we provide DNS as an inclusion in every security assessment that we do. So it’s not enough to just have a domain, but it must be secured and must be signed,” he said.

DNSSEC is a security extension to the Domain Name System (DNS). DNS translates domain names into the numerical addresses computers use to find websites and online services. DNSSEC adds digital signatures that allow validating resolvers to check whether DNS responses are authentic and have not been tampered with.

NiRA warns on implementation

NiRA President Adesola Akinsanya described DNSSEC as an important layer of protection for Nigeria’s digital infrastructure as cyber threats rise. He warned that implementing it without technical expertise could create new problems, including making websites inaccessible to users whose DNS resolvers validate signatures.

“Our priority must therefore be competence, coordination and careful implementation, rather than adoption for its own sake,” Akinsanya said.

He said DNSSEC does not encrypt internet traffic, prevent distributed denial-of-service attacks or protect against compromised registrar credentials. It must work with other cybersecurity measures. He also called for cooperation among government agencies, internet service providers, domain registrars, businesses and cybersecurity professionals.

Cyber threats and fraud costs

Akinsanya cited Check Point figures showing that the average Nigerian organisation faced about 4,361 attempted cyberattacks weekly in June, against a global average of about 2,270. He also referenced Nigeria Inter Bank Settlement System (NIBSS) figures showing digital payment fraud amounted to N25.85 billion in 2025, despite a decline in reported incidents. He warned that fewer reports do not automatically mean better security, as underreporting could distort the picture.

“DNS security is not a technical hobby. It is an economic question,” he said. He urged government institutions to review the security of their domain names, control account access properly and activate multi factor authentication to reduce the risk of unauthorised changes.

Nigeria officially unveiled DNSSEC on the .ng domain in April this year. NiRA carried it out during a media advocacy and capacity building workshop in Lagos on Thursday. The move placed Nigeria among countries adopting advanced technologies to secure their internet ecosystems.

For Nigerian businesses and consumers, the policy puts more focus on the domain layer that sits behind government websites and online services. Weak domain security can add to the fraud and disruption risks that organisations already face.