The National Information Technology Development Agency (NITDA) has directed all Ministries, Departments and Agencies (MDAs) of government to implement the Domain Name System Security Extensions (DNSSEC) architecture, warning that compliance will form part of its cybersecurity assessment protocol.
The directive underscores the growing importance of securing Nigeria’s digital infrastructure against cyber threats, with the agency insisting that government-owned domains must be protected against tampering and other vulnerabilities.
Director-General of NITDA, Malam Kashifu Inuwa Abdullahi, stated this at a Cybersecurity Awareness Webinar organised by the Nigeria Internet Registration Association (NiRA) through its .ng Academy to commemorate Cybersecurity Awareness Month.
The webinar, held on Monday, was themed “Securing Nigeria’s Digital Foundation: DNSSEC, the .ng Domain, and the Future of National Cyber Resilience”.
Represented by Mr. Oluwasegun Falayan, the NITDA chief stressed the need to embed DNS security into the country’s digital infrastructure to protect domain names and strengthen Nigeria’s position in the global digital ecosystem.
He described DNSSEC implementation as a necessity at the country’s current stage of digital development, urging stakeholders to address implementation challenges while ensuring that the necessary support systems were established to facilitate adoption.
“Security goes beyond just the physical, but also our private space must also be secured.”
He added, “So we must lead, we must ensure that every .gov.ng is signed as much as possible, and we provide DNS as an inclusion in every security assessment that we do. So it’s not enough to just have a domain, but it must be secured and must be signed.”
The directive places particular emphasis on government domains, signalling that merely registering a domain name would no longer be sufficient without appropriate security measures.
Speaking at the webinar, NiRA President, Mr. Adesola Akinsanya, called for a shift in focus from the number of domain names registered to the quality, reliability and security of Nigeria’s digital naming infrastructure.
He cautioned that poorly configured DNSSEC could inadvertently make websites inaccessible to users whose DNS resolvers validate digital signatures, stressing that successful implementation requires technical competence and coordination.
“There is also a critical consideration: where DNSSEC is improperly configured, domains can become inaccessible to users whose resolvers validate signatures. Our priority must therefore be competence, coordination and careful implementation, rather than adoption for its own sake,” he noted.
Akinsanya explained that the Domain Name System (DNS), often described as the internet’s phonebook, enables users to locate websites and online services, while DNSSEC introduces a layer of authentication through digital signatures that allow validating resolvers to verify the authenticity and integrity of DNS responses.
He, however, warned that DNSSEC is not a standalone solution to cybersecurity threats.
“However, DNSSEC does not encrypt internet traffic, prevent traffic-flooding attacks, or protect against compromised registrar credentials. It is an important layer of security, but it must work alongside other protective measures to create a resilient digital ecosystem,” Akinsanya explained.
To illustrate the urgency of strengthening digital security, the NiRA president cited figures indicating that Nigerian organisations face a substantial volume of cyberattacks, while financial losses associated with digital-payment fraud remain significant.
“Check Point reports that the average Nigerian organisation faced about 4,361 attempted attacks a week in June, against a global average of about 2,270. NIBSS reports digital-payment fraud of ₦25.85 billion in 2025, even as reported incidents fell, which NIBSS itself warns may signal under-reporting rather than safety. DNS security is not a technical hobby. It is an economic question.”
He noted that the cybersecurity awareness campaign should compel organisations to address basic but consequential weaknesses in their digital systems.
“October is Cybersecurity Awareness Month, and the National Cybersecurity Alliance’s call this year is plain: “Don’t make it easy for them.” This morning is about the easy things: the unlocked, the unsigned and the unmonitored.”
Akinsanya also clarified the respective responsibilities of NiRA and other actors in securing the country’s domain-name infrastructure, noting that the association operates the .ng registry but does not control the DNS systems, registrar accounts or security operations of individual organisations.
“NiRA runs the registry. We sign the zone, publish accurate data, support registrars and convene. We do not run your DNS, manage your registrar account, choose your provider’s resolver, or investigate crime. That is the case for partnership.”
He called on government institutions to review access to their domain-management accounts, ensure multi-factor authentication was enabled and establish clear procedures for responding to unauthorised changes.
“Government bodies: review the domains you run. Who holds the login? Is multi-factor authentication on? Who is called at three in the morning when records change?
“Regulators: make sure the naming layer is named in the forthcoming cybersecurity framework and in critical-infrastructure planning.
“Internet providers: switch on validation and keep your resolvers patched.
“Registrars: 15 of 164 is not a number I can defend.
“Businesses: ask your provider whether your domain is signed and who can change your records.
“Security professionals: share what you see and report incidents, because under-reporting is the enemy of everything we discuss today.”
The NiRA president maintained that efforts to expand the .ng domain space must not compromise security, arguing that confidence in the country’s digital identity was more important than pursuing registration targets without adequate safeguards.
“But I am not asking for more domains for their own sake. A .ng that is unsafe or unreliable is worse than none.”
He urged registrars, internet service providers, government institutions, technical communities and other stakeholders to collaborate in expanding DNSSEC adoption, strengthening technical capacity and building trust in Nigeria’s digital infrastructure.
“Securing our digital foundation is a shared responsibility, and our collective commitment will determine how effectively we protect the future of the .ng namespace and Nigeria’s wider digital economy. A .ng name is more than an address. It is a statement of where you belong and who answers when something goes wrong. Of the figures reported this year, .ng has roughly one domain for every thousand Nigerians; Kenya has about two, and South Africa about twenty.”
During a panel session, the Head of Incident Handling at the Nigeria Computer Emergency Response Team (ngCERT), operating under the Office of the National Security Adviser (ONSA), Daniel Onyekpeze, attributed the growing cybersecurity challenge to the rapid industrialisation of social engineering, the use of artificial intelligence in cyberattacks and increased exposure of sensitive data.
He proposed an executive order granting DNSSEC Critical National Information Infrastructure (CNII) status, arguing that its implementation should extend across sectors, including financial services, and be carried out correctly.
Also speaking, the IT and Cybersecurity Officer at the Nigeria Data Protection Commission (NDPC), Abubakar Mahmud, who represented the commission’s National Commissioner and Chief Executive Officer, Dr. Vincent Olatunji, noted that large volumes of data could attract cyberattacks.
A representative of the Nigeria Police Force National Cybercrime Centre (NCCC), SP Kuma Ikyereve, identified phishing as the leading category of cybersecurity cases, while the founder and chief executive officer of CyberPlural, Lateef Hamzat, observed that cybercriminals were increasingly shifting their attention from individuals to systems.
Participants at the webinar agreed that Nigeria must prioritise the implementation of DNSSEC as part of broader efforts to protect its digital infrastructure, warning that expanding the number of registered domains without adequate security could expose organisations and users to avoidable risks.
They consequently called on organisations to take advantage of the available DNSSEC resources, strengthen their implementation capacity, and work collectively to safeguard sensitive information, improve digital trust, and protect the country’s growing digital economy.