DNSSEC Compatibility With Other DNSimple Features
Last updated
Most DNSimple features work with DNSSEC, including vanity name servers, ALIAS records, and email forwarding. DNSSEC can’t be used with DNSimple as a secondary DNS server, on reverse DNS zones, or across a subdomain delegated with NS records, and it only partly works with DNSimple as a primary for other secondary providers. The following table summarizes the compatibility of each feature.
| Feature | Compatible | Notes |
|---|---|---|
| Secondary DNS (DNSimple is Primary) | Partially | AXFR zone transfers do not include RRSIG records, so secondary providers must sign the zone themselves and their DS records must be published too. It works for hidden backup, or if the secondary provider performs the signing independently. See Why DNSSEC and Secondary DNS May Not Work Together. |
| Secondary DNS (DNSimple is Secondary) | No | Inbound AXFR replaces the entire zone, removing any existing DNSKEY and RRSIG records. DNSSEC cannot be enabled alongside Secondary DNS with DNSimple as Secondary. |
| Vanity name servers | Yes | Vanity name servers use the same signing as the standard DNSimple name servers. |
| ALIAS records | Yes | ALIAS records are resolved dynamically on DNSimple’s name servers and served as standard A/AAAA records, which are signed normally by DNSSEC. |
| Email forwarding | Yes | Email forwarding adds standard MX and TXT records, which are signed normally by DNSSEC. |
| Domain Control Plane (integrated DNS providers) | No | DNSSEC records are not synced between DNSimple and integrated DNS providers. Configure DNSSEC directly with each provider. |
| Reverse DNS | No | Reverse DNS zones do not currently support DNSSEC. DNSSEC is enabled per domain, and reverse zones aren’t domains. |
| Subdomain delegation (zone cuts) | No | DS records cannot be published for a subdomain delegated with NS records, so the DNSSEC chain of trust cannot extend across a zone cut to the name servers hosting the subdomain. |
Have more questions?
If you have any questions about DNSSEC compatibility with DNSimple features, contact support, and we will be happy to help.