A DNSSEC key rollover replaces signing keys while allowing cached trust information to remain valid during the transition. A KSK or combined signing key change can require a parent DS update; an ordinary ZSK rotation often does not. Follow the signing platform's actual key policy.
IN THIS ARTICLE
What you need before you begin
Identify the key role being changed and whether the provider automatically manages parent updates through a supported process. Record DNSKEY, signature and DS lifetimes and keep a tested recovery route. A compromised key needs the provider's incident procedure, not an ordinary leisurely rotation.
01 Coordinate a DNSSEC key rollover with the registrar's DS update
- Use the provider's supported rollover workflow to generate and publish the new key material. Do not remove the old key before the required overlap has begun.
- Confirm all authoritative servers serve the intended DNSKEY set and signatures. Allow the new public information to become available according to the provider's timing policy.
- Where parent trust changes, submit the new DS through the correct parent operator. Some rollovers use overlapping DS records, but only follow this when both parent and signer support the planned sequence.
- Validate the chain using the newly published trust information and observe the old DS/DNSKEY cache lifetimes. A successful fresh query does not prove every resolver has discarded old trust data.
- Retire old DS and key material only at the stages approved by the signer's rollover plan. Retest after each stage and keep the audit record of times and identifiers.
Verify the authoritative DNS result
Validate representative names and record types from independent resolvers throughout the overlap and after retirement. Confirm no authoritative server is still publishing an inconsistent key or expired signature set.
Troubleshoot unexpected results
If validation fails, stop further key deletion and compare parent DS, child DNSKEY and signature timing. Recover a consistent state with the provider; do not reintroduce a known-compromised key just to make a test pass.
A common question
Does every DNSSEC key change require me to edit the registrar DS?
No. The answer depends on the key's role and the signing design. The DS normally authenticates the relevant child trust key, while routine data-signing rotations may remain beneath that trust point. Follow the provider's notification rather than matching every changed key tag manually.