Confirm Plesk is authoritative, the DNSSEC extension and permissions are available, and the registrar supports DS management. Export the existing zone and record current delegation and DS values. Arrange a maintenance window and a person who can change both Plesk and registrar settings.

1. Open the domain DNSSEC settings and review the supported signing parameters and key lifecycle. Use settings appropriate to the server and registrar compatibility.
2. Sign the zone through the supported panel action. Verify that all authoritative servers serve the signed data consistently before changing the parent.
3. Copy the DS values produced by Plesk exactly, including key tag, algorithm, digest type and digest. Add them through the registrar parent-zone DNSSEC workflow.
4. Wait for the relevant delegation and cache changes, then check validation through a DNSSEC-aware lookup. Keep the original signing keys protected as part of the supported backup strategy.
5. Document key-rollover notifications and who will update DS records when required. Include DNSSEC in any future DNS-hosting migration plan.

Confirm a validating resolver returns the expected answer and that the DS and DNSKEY relationship is correct. Test more than one independent resolver and each authoritative nameserver. Keep the validation evidence with the change record.

If validating resolvers return SERVFAIL while nonvalidating queries succeed, inspect the trust chain promptly. Do not simply disable signing while a DS record remains published. Coordinate removal or replacement of the parent DS and observe relevant cache lifetimes before withdrawing the corresponding signed zone or key.

• Knowing when Plesk DNS changes control public records
• Updating a Plesk server DNS template without surprising customers
• Issuing and renewing a certificate with Plesk SSL It
• Adding supported Apache and nginx directives in Plesk

• Plesk: Using Dnssec
• Plesk: Configuring Dnssec For A Domain