DNS

DNSSEC for a domain on ZRAZU servers

How to turn DNSSEC on and off for a domain on ZRAZU DNS: what zone signing is, where to get the DS record and what to do with a DS left by a previous provider.

DNSSEC adds a digital signature to the zone. Thanks to it, nobody can quietly forge your DNS answers. It is optional, but useful.

DNSSEC is available when the domain uses our name servers ns1.zrazu.net, ns2.zrazu.net and ns3.zrazu.net. First turn on the DNS zone and move the domain to ZRAZU servers.

How to turn it on

  1. In the cabinet open the domain and its DNS tab.
  2. In the DNSSEC block turn on the DNSSEC zone signing switch.
  3. Wait for the steps. The cabinet shows them in words: "Signing the zone, waiting for all name servers", then "Adding the DS to the registry", and finally "DNSSEC is working".

For domains registered with ZRAZU we enter the DS record in the registry ourselves. For a domain at another registrar the cabinet asks: "Enter the DS at the domain's registrar". In that case:

  1. In the DNSSEC block copy the DS record (Key tag, Algorithm, Digest type, Digest) or use As one line. Some registrars ask for the DNSKEY instead: Flags, Protocol, Algorithm and Public key.
  2. Enter them in your registrar's panel, in its DNSSEC section.
  3. Wait for the state "DNSSEC is working".

DS and DNSKEY are public data. It is safe to copy them.

How to turn it off

  1. Turn the DNSSEC zone signing switch off and confirm with Yes, turn DNSSEC off.
  2. First we remove the DS from the registry, and only later the zone signature. There is no rush: while the old DS lives in caches, the signature has to stay, so the domain keeps opening. At the moment this is no less than two days.
  3. While DNSSEC is on or being removed, you cannot switch to foreign name servers. Turn DNSSEC off first. You can turn it on again once the signature is removed.

A foreign DS in the registry

If another provider used to sign the domain, its DS may remain in the registry. Before moving to ZRAZU servers remove it with Remove the DS in the registry and confirm with Yes, remove the DS. Do this only if the domain is no longer signed on the old name servers: otherwise it may stop opening.

DNSSEC can be changed by a role with DNS rights: owner, administrator or technician.

If it didn't work

  • "Move the domain to ZRAZU name servers first". DNSSEC works only with our servers.
  • "A step is delayed, we are already looking". Nothing to do, we will see it ourselves.
  • "DNSSEC is still being turned off". Wait until the signature is removed, then turn it on again.
  • "A change of name servers is planned for the domain". DNSSEC can be turned on once the change is applied or cancelled.
  • The domain does not open after entering the DS at the registrar. Check that the DS was copied in full and matches the zone's current key.

This page in Markdown