The National Information Technology Development Agency (NITDA) has strengthened cybersecurity requirements for government institutions, making Domain Name System Security Extensions (DNSSEC) part of its cybersecurity assessment framework for Ministries, Departments and Agencies (MDAs).
The agency is also urging government institutions using the .gov.ng domain to adopt DNSSEC to protect their websites against certain cyberattacks and strengthen trust in Nigeria’s digital infrastructure.
Kashifu Inuwa Abdullahi, NITDA’s Director-General, disclosed the policy at a cybersecurity awareness webinar organised by the Nigeria Internet Registration Association (NiRA) through its .ng Academy on Monday.
The event, held as part of Cybersecurity Awareness Month, was themed Securing Nigeria’s Digital Foundation: DNSSEC, the .ng Domain, and the Future of National Cyber Resilience.
Represented by Oluwasegun Falayan, Abdullahi said DNS security would become a component of the agency’s cybersecurity assessments, emphasising that government institutions must secure their domain names rather than merely register them.
“So we must lead, we must ensure that every .gov.ng is signed as much as possible, and we provide DNS as an inclusion in every security assessment that we do. So it’s not enough to just have a domain, but it must be secured and must be signed,” he said.
The Domain Name System (DNS) translates website names into numerical addresses that computers use to locate websites and online services.
DNSSEC adds digital signatures to DNS records, allowing systems that validate those signatures to verify the authenticity of responses and detect certain forms of tampering.
Adesola Akinsanya, NiRA President, described the technology as an important layer of protection for Nigeria’s digital infrastructure as cyber threats continue to grow.
However, he warned that adopting DNSSEC without the necessary technical expertise could introduce new vulnerabilities or operational problems, including making websites inaccessible when signature validation fails.
“Our priority must therefore be competence, coordination and careful implementation, rather than adoption for its own sake,” Akinsanya said.
He stressed that DNSSEC is not a complete cybersecurity solution. It does not encrypt internet traffic, prevent distributed denial-of-service (DDoS) attacks or protect against compromised domain registrar credentials.
Effective protection, he said, requires DNSSEC to work alongside other cybersecurity measures, supported by coordination among government agencies, internet service providers, domain registrars, businesses and cybersecurity professionals.
Akinsanya highlighted the economic implications of weak digital security, citing figures attributed to cybersecurity firm Check Point showing that the average Nigerian organisation faced approximately 4,361 attempted cyberattacks weekly in June, compared with a global average of about 2,270.
He also referenced Nigeria Inter-Bank Settlement System (NIBSS) figures indicating that digital payment fraud amounted to N25.85 billion in 2025, despite a decline in reported incidents.
Akinsanya cautioned that fewer reported incidents did not necessarily indicate stronger security, as underreporting could distort the picture.
“DNS security is not a technical hobby. It is an economic question,” he said.
He urged government institutions to review their domain security, strengthen access controls and activate multi-factor authentication to reduce the risk of unauthorised changes to their digital infrastructure.
