DNSSEC Management in DNSimple

Last updated October 30, 2026

You manage DNSSEC for each domain on its DNSSEC tab. That’s where you enable and disable DNSSEC, see its status and the active key set, and follow a key rotation. DS records for a domain registered with DNSimple are on the Registration tab, under DS Records. This page labels each part of those screens. For step-by-step instructions, see Enable DNSSEC, Disable DNSSEC, and Add and Remove DS Records.

1. DNSSEC tab - DNSSEC management options for the domain.
2. Enable DNSSEC link on the DNSSEC is disabled card - Opens the Enable DNSSEC page.

Enable DNSSEC

1. Manage DS Records button (DS Record Management Only card) - Add DS records for a domain whose zone is signed by another DNS provider.
2. Continue button (Fully Managed DNSSEC card) - Goes to options to have DNSimple fully manage the domain’s DNSSEC. For a domain already delegated to DNSimple, this button is Enable DNSSEC instead.

The screenshot shows a domain registered with DNSimple. For a domain registered elsewhere, the page shows a Use DNSSEC with my current registrar card with an Enable DNSSEC button, and the Fully Managed DNSSEC card asks you to transfer the domain to DNSimple.

Add DS Record For Domain Not Delegated to DNSimple

DS records are added for the registered domain only. Adding DS records for a delegated subdomain (a zone cut) is not supported. See DNSSEC Compatibility With Other DNSimple Features.

1. Add DS Record button - Add a DS record.

1. Algorithm - Choose algorithm type for the DS record.
2. Key tag - Enter the key tag number.
3. Digest Type - Select the digest type for the DS record.
4. Digest - Enter the digest provided by your current DNS provider.
5. Public Key - Enter the public key of the Key-Signing Key (KSK) of your zone signing configuration provided by your DNS provider.
6. Add DS record button - Adds the DS record to DNSimple for the domain.

Fill in either the digest fields (2-4) or the public key (5). The algorithm is always required.

Enable Fully Managed DNSSEC

1. Continue button - Goes to options to have DNSimple fully manage the domain DNSSEC.
2. Enable DNSSEC button - Enables fully managed DNSSEC.
3. Change Delegation button - Only available if the domain is not delegated to DNSimple.
4. Manage DS Records button - Used to manage DS Records when the domain is using another DNS provider.

Enabling DNSSEC

1. Enabling Notification - Notification that DNSSEC is being enabled.
2. We are Enabling DNSSEC on (domain) Card - Status card for DNSSEC.
3. Refresh page button - Refreshes page and status.

1. DNSSEC is enabled on (domain) card - Shows DNSSEC is enabled on the domain. Below it, Active Key Set shows the key set’s algorithm, key tag, creation date, and next scheduled rotation.
2. Disable DNSSEC button - Disables DNSSEC on the domain.

Rotating keys

During an automatic key rotation, the card reads DNSSEC key sets are being rotated. and a Next Key Set section appears. For a domain registered elsewhere, Next Key Set shows the new DS record in both DS-data and KEY-data format, with a copy button for each, so you can add it at your registrar.

Disable DNSSEC

After clicking on the Disable DNSSEC button in the Disable DNSSEC card, you will start the process of disabling DNSSEC.

1. Confirm - Type the domain name to confirm.
2. Disable DNSSEC button - Disables DNSSEC on the domain.

Disabling DNSSEC

1. Disabling Notification - Notification that DNSSEC is being disabled.
2. We are Disabling DNSSEC on (domain) Card - Status card for DNSSEC.
3. Refresh page button - Refreshes page and status.

Have more questions?

If you have any questions or need assistance with your DNSSEC management, contact support, and we will be happy to help.