DNSSEC
DNSSEC protects a zone with cryptographic signatures and lets validating resolvers prove that the answer came from the intended DNS chain.
Where to find it: DNS Zones > DNSSEC on a zone, or Zone Editor > DNSSEC controls.
Available to: Users allowed to read the zone can inspect public state; signing mutations require effective zone-write permission.
What this page does
The DNSSEC modal shows whether signing is configured and authoritative, the DS records that belong at the parent, public DNSKEY details, cache/readiness state, and any staged rollover. It supports enable, refresh, begin/activate/complete rollover, and safe disablement.
Before you start
Confirm the zone is healthy and delegated to the authoritative nameservers you are managing. Ensure you can edit DS records at the registrar or parent. Keep a backup and do not begin a rollover while another key change is unresolved.
Enablement flow
- Select Enable DNSSEC. SDM creates signing material, enables authoritative metadata, rectifies the zone, clears relevant cache, and registers the change for synchronization.
- Refresh until authoritative readiness is reported and copy the returned DS record exactly.
- Add that DS record at the parent or registrar.
- After propagation, refresh SDM and query validating public resolvers. Signing without a parent DS is secure locally but does not complete the public chain.
Staged rollover: begin, activate, complete
| Phase | What happens | Operator checkpoint |
|---|---|---|
begin | Publishes a new inactive combined signing key alongside the old active key. | Wait until the new DNSKEY is visible from every authoritative node. |
activate | Activates the new key and returns the new DS material. | Update the parent DS and verify it publicly before retiring anything. |
complete | Retires the old key after the new chain is in service. | Confirm validating resolution and no pending synchronization. |
Safe disablement
Remove DS records at the parent first, wait until public resolvers no longer see them, then select Disable and type the exact zone name. SDM normally refuses to disable while parent DS records are still observed. Force is a root recovery mechanism and is not available to normal external API users.
How to use it
- Open DNSSEC and read configured, enabled, authoritative-ready, parent-DS, key, and rollover state.
- Choose only the next valid action.
- Copy public DS/DNSKEY material with the copy control; never handle private key material in the UI.
- Make the matching parent change when required.
- Refresh SDM, authoritative DNS, and a validating public resolver before advancing.
Result and next check
A healthy enabled zone is signed, authoritative servers publish the expected DNSKEY set, the parent publishes the matching DS, and validating resolution succeeds. A safely disabled zone has no parent DS before local signing is removed.
Theme color