diff --git a/machines/forms.py b/machines/forms.py
index abc96811..94b9293a 100644
--- a/machines/forms.py
+++ b/machines/forms.py
@@ -273,6 +273,7 @@ class ExtensionForm(FormRevMixin, ModelForm):
         self.fields['origin'].label = _("A record origin")
         self.fields['origin_v6'].label = _("AAAA record origin")
         self.fields['soa'].label = _("SOA record to use")
+        self.fields['dnssec'].label = _("Sign with DNSSEC")
 
 
 class DelExtensionForm(FormRevMixin, Form):
diff --git a/machines/migrations/0097_extension_dnssec.py b/machines/migrations/0097_extension_dnssec.py
new file mode 100644
index 00000000..48e41f77
--- /dev/null
+++ b/machines/migrations/0097_extension_dnssec.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.7 on 2018-12-24 14:00
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('machines', '0096_auto_20181013_1417'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='extension',
+            name='dnssec',
+            field=models.BooleanField(default=False, help_text='Should the zone be signed with DNSSEC'),
+        ),
+    ]
diff --git a/machines/models.py b/machines/models.py
index 1ad783f1..888e4ac0 100644
--- a/machines/models.py
+++ b/machines/models.py
@@ -696,6 +696,10 @@ class Extension(RevMixin, AclMixin, models.Model):
         'SOA',
         on_delete=models.CASCADE
     )
+    dnssec = models.BooleanField(
+        default=False,
+        help_text=_("Should the zone be signed with DNSSEC")
+    )
 
     class Meta:
         permissions = (
diff --git a/machines/templates/machines/aff_extension.html b/machines/templates/machines/aff_extension.html
index b8493f5f..2eb893e9 100644
--- a/machines/templates/machines/aff_extension.html
+++ b/machines/templates/machines/aff_extension.html
@@ -56,6 +56,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
                     {% acl_end %}
                     {% history_button extension %}
                 </td>
+                <td>{{ extension.dnssec|tick }}</td>
             </tr>
         {% endfor %}
     </table>