Search... ⌘ K
Get Started Contact Sales

Disable DNSSEC

Last updated

To disable DNSSEC, open the tab for your domain, click , and confirm by typing the domain name. If your domain is registered with DNSimple, we remove the DS record for you. If it’s registered elsewhere, you also need to remove the DS record at your registrar. The process usually takes 24 to 48 hours.

Disable DNSSEC

To disable DNSSEC
  1. Select the correct account in the account switcher at the top of the page. Account switcher menu with an arrow pointing to an account to switch to
  2. From your list, click the name of the domain you want to disable DNSSEC on. Domain Names list with an arrow pointing to a domain name
  3. Click the tab on the left side. Domain page sidebar with an arrow pointing to the DNSSEC tab
  4. On the card, click . Disable DNSSEC card with an arrow pointing to the Disable DNSSEC button
  5. Enter the domain name to confirm, and click again. screenshot of confirming disabling of dnssec

Warning

If the zone has TLSA records, they rely on DNSSEC. After you disable DNSSEC, clients can no longer verify them.

Note

To learn how to disable DNSSEC with the API, check out our developer documentation.

Important timing considerations

When you disable DNSSEC, it usually takes 24 to 48 hours for the process to finish. We keep your zone signed until the DS record is gone from the parent zone, then wait another 24 hours for cached copies of the DS record to expire (its TTL). Only then do we remove the signing keys, so your domain keeps resolving throughout.

If your domain is registered with DNSimple, we remove the DS record at the registry for you. No action is needed.

If your domain is registered elsewhere, we email you the key tag of the DS record to remove. Remove that DS record at your registrar within 30 days. If it’s still in place after that, the disable operation is cancelled.

After DNSSEC is disabled, you can enable it again once the process is complete (at least 24 hours).

Troubleshooting

If you encounter issues after disabling DNSSEC, see Troubleshoot DNSSEC for comprehensive guidance. For information about managing DS records when changing DNS providers, see Manage DS Records When Changing DNS.

Learn more

To learn more about DNSSEC, see What Is DNSSEC?. For information about enabling DNSSEC, see Enable DNSSEC. For information about DS records and how they work, see What Are DS Records?. To understand TTL and how it affects DNS record propagation, see What Is Time-to-Live?. For a complete overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.

Have more questions?

If you have any questions or need assistance disabling your DNSSEC, contact support, and we will be happy to help. You can also read more about domain and DNS security at DNSimple.