The DNSSEC API requests signing changes for an owned zone on a capable provider. A successful request is only one part of the trust chain. The registrar or parent-zone operator must publish the matching DS information through its own permitted workflow.
| Method | Resource | Scope | Idempotency-Key |
|---|---|---|---|
GET |
/v2/dns/zones/{zoneId}/dnssec |
dns:read |
Not required by this route |
POST |
/v2/dns/zones/{zoneId}/dnssec/enable |
dns:dnssec |
Required |
POST |
/v2/dns/zones/{zoneId}/dnssec/disable |
dns:dnssec |
Required |
IN THIS ARTICLE
01 Enable signing in the correct order
- Confirm the assigned provider and package support DNSSEC and that your credential has
dns:dnssec. Check whether the provider requires additional key-service permissions. - Record the current parent DS state and authoritative nameservers. Resolve an active DNS migration before adding a new trust dependency.
- POST to
dnssec/enablewith an idempotency key, then track the resulting operation and provider status. - Obtain the actual DS values from the supported DNS Manager or provider signing interface after signing is ready. Do not derive values from a hostname or copy another zone's DS.
- Publish the matching DS through the registrar or parent-zone administrator and verify validation through the complete delegation.
02 Interpret the status response correctly
The current GET helper reports the zone ID, status and last checked time. It does not promise to return DS records, signing keys or a complete trust-chain analysis. Keep your integration's parent DS verification separate from this management status.
Before disabling signing, coordinate removal or replacement of the parent DS according to the provider's rollover procedure. Leaving a parent DS pointing to an unsigned or differently signed zone can cause validating resolvers to reject otherwise present records. Providers that require permanent signing may not offer a disable operation.
Common questions
Does enable automatically update my registrar?
Do not assume it does. Verify the parent DS explicitly and use the applicable registrar workflow. A domain and its authoritative DNS can be managed by different companies.
Why does the provider permission check fail when ordinary records work?
Signing may need separate provider privileges or configuration. For example, a key-management dependency can require permissions beyond reading or editing zone records. Diagnose the specific provider response.
Should I repeatedly toggle DNSSEC to fix SERVFAIL?
Inspect the parent DS, child DNSKEY and authoritative signatures first. Repeated changes can leave several cache states in circulation and obscure the original mismatch. Escalate with the domain, current DS evidence, affected resolver and observed time.