The National Information Technology Development Agency (NITDA) has added Domain Name System Security Extensions (DNSSEC) to the cybersecurity assessment criteria for federal Ministries, Departments and Agencies (MDAs), placing greater emphasis on protecting the domain names used to deliver government services online.
The policy was announced during a Cybersecurity Awareness Month webinar organised by the Nigeria Internet Registration Association (NiRA) through its .ng Academy. The event, themed “Securing Nigeria’s Digital Foundation: DNSSEC, the .ng Domain, and the Future of National Cyber Resilience,” brought together government officials and digital infrastructure stakeholders to discuss ways to strengthen Nigeria’s online security.
NITDA also called on government institutions operating websites under the .gov.ng domain to implement DNSSEC, stressing that registering an official domain name is not enough without measures to protect its integrity.
Why DNS security matters
Speaking on behalf of NITDA Director-General Kashifu Inuwa Abdullahi, agency official Oluwasegun Falayan said DNS security would become part of the agency’s cybersecurity assessment process.
The Domain Name System (DNS) functions like the internet’s address directory. It translates domain names, such as those used by government websites, into numerical addresses that computers use to locate online services.
When a user enters a website address, DNS helps direct the browser to the corresponding server. If attackers manipulate this process, users may be sent to fraudulent destinations even when they believe they are accessing a legitimate website.
DNSSEC is designed to reduce this risk by adding cryptographic digital signatures to DNS records. These signatures allow validating systems to check whether DNS responses are authentic and have not been altered.
For government institutions, the technology provides an additional layer of protection for official web addresses that citizens rely on to access public information and services.
However, DNSSEC does not encrypt internet traffic or provide complete protection against cyberattacks. It must operate alongside other security controls, including secure account management, access restrictions, and broader network protection.
NITDA calls for stronger protection of .gov.ng websites
NITDA’s announcement places particular emphasis on government domain names, which serve as digital entry points for public services.
As federal institutions expand their use of online portals, the integrity of these addresses becomes increasingly important. Citizens may use government websites to obtain information, submit applications, or access services involving sensitive personal and financial details.
A compromised domain could expose users to fraudulent websites, phishing attempts or other forms of online deception.
Focusing on domain security therefore addresses a specific part of the wider cybersecurity challenge facing public institutions.
Falayan stressed that government agencies must go beyond simply registering domain names and ensure they are properly secured.
The agency’s stated position is that DNS security should form part of routine cybersecurity assessments rather than remain an optional technical measure.
The report does not provide a detailed implementation timetable, a specific compliance deadline or a complete schedule of penalties for agencies that fail to meet the requirements.
NiRA warns against poorly managed implementation
NiRA President Adesola Akinsanya supported the push for stronger domain protection but cautioned that deploying DNSSEC requires appropriate technical expertise and careful management.
He argued that protecting Nigeria’s domain infrastructure should take priority over simply increasing the number of registered .ng domains.
According to Akinsanya, a single compromised government domain could undermine public confidence in official digital services and damage trust in Nigeria’s wider online environment.
He also warned that incorrectly configured DNSSEC can create operational problems. For example, users whose DNS resolvers validate digital signatures may be unable to access a website if its DNSSEC configuration is broken.
This makes technical competence, coordination and careful implementation important to the success of the policy.
NiRA said it would work with NITDA through its .ng Academy to strengthen the skills of government system administrators. The training initiative is intended to support implementation, including the management of cryptographic keys and the prevention of configuration errors.
DNSSEC cannot replace other cybersecurity measures
Although DNSSEC can help prevent certain forms of DNS manipulation, it does not address every threat facing government websites.
Akinsanya noted that the technology does not encrypt web traffic, prevent distributed denial-of-service (DDoS) attacks or protect against compromised domain registrar credentials.
This means an agency could implement DNSSEC and remain vulnerable to attacks involving stolen administrative accounts, insecure applications or weaknesses elsewhere in its systems.
Effective protection therefore requires a combination of technical controls and sound security practices.
During the webinar, Akinsanya also urged public institutions to review their domain configurations, strengthen control over administrative accounts and activate multi-factor authentication to reduce the risk of unauthorised changes.
The broader message is that securing a government domain requires more than installing one technology. Agencies must ensure that the systems and people responsible for managing their digital assets can maintain those protections over time.
Cybersecurity threats carry financial consequences
Akinsanya cited figures attributed to Check Point indicating that the average Nigerian organisation faced approximately 4,361 attempted cyberattacks per week in June, compared with a global average of about 2,270.
He also referenced Nigeria Inter-Bank Settlement System (NIBSS) figures showing that digital payment fraud amounted to ₦25.85 billion in 2025, despite a decline in reported incidents.
The figures were cited during the webinar to illustrate the potential economic consequences of weak digital security. They do not, by themselves, establish how much of the reported activity involved DNS-related attacks.
Akinsanya cautioned that a decline in recorded fraud incidents should not automatically be interpreted as evidence that security has improved, since underreporting may affect the figures.
He described domain security as an economic concern as well as a technical one, pointing to the need to protect digital transactions, public services and confidence in online systems.
Nigeria builds on earlier DNSSEC adoption
The latest directive follows Nigeria’s introduction of DNSSEC on the .ng domain in April 2026.
NiRA, which manages Nigeria’s country-code top-level domain, announced the development during a media advocacy and capacity-building workshop in Lagos.
The earlier initiative was intended to strengthen security across the country’s domain infrastructure. NITDA’s decision to incorporate DNS security into government cybersecurity assessments extends the focus to how public institutions secure the domains they operate.
The two developments highlight the importance of protecting both the underlying national domain infrastructure and the individual websites that government agencies use to communicate with citizens.
Source: Innovation Village