Appearance

Managing DNSSEC ​

Warning

Using DNSSEC requires in-depth technical knowledge. Leave the fields on this page empty if you don't know what they mean. Incorrect DNSSEC records can make the domain unreachable.

DNSSEC cryptographically signs a domain's DNS responses, protecting against manipulation of DNS resolution. For DNSSEC, the key data generated by your own DNS server is recorded with the registry.

Prerequisites ​

Before entering DNSSEC keys, check:

  • that your DNS zone already supports and actively signs with DNSSEC
  • that you have the correct key data (flags, protocol, algorithm, public key) from the DNS server

Step-by-step guide ​

1. Open the domain ​

Open the desired domain under Domain and go to the DNSSEC section.

2. Enter the key data ​

For up to three keys (Key #1 through Key #3), you can enter the following values:

  • Flags
  • Protocol
  • Algorithm
  • Public key

All fields are optional; leave unused keys completely empty.

3. Save your changes ​

Click Update.

Follow-up checks ​

After saving, check:

  • that the domain is still reachable
  • that DNSSEC validation succeeds with an external validation tool

Common issues ​

Domain unreachable after entering keys ​

Possible causes:

  • the entered key data doesn't match the keys actually used by the DNS zone
  • the DNS zone isn't signing, or no longer signs, with the entered keys

DNSSEC validation fails ​

Possible cause:

  • outdated key data wasn't removed after the DNS zone started using new keys