Search... ⌘ K
Get Started Contact Sales

Rotate DNSSEC Keys

Last updated

DNSimple rotates your key-signing key and zone-signing key automatically, starting 83 days after they were created. Rotation is mandatory and can’t be disabled. Because the key-signing key changes, the DS record at the parent zone changes too. If your domain is registered with DNSimple, we update it for you. If it’s registered elsewhere, you add the new DS record and remove the old one at your registrar.

If your domain is registered with DNSimple, a rotation usually takes 48 to 72 hours. If it’s registered elsewhere, the rotation lasts until you’ve updated the DS records at your registrar, and you have up to 30 days for each step. The tab shows that key sets are being rotated while it’s in progress.

Here is what you need to do, depending on how your domain is set up.

If your domain is registered with us

In this scenario, DNSSEC is fully managed by DNSimple, which includes the management of the DS records in the parent zone. There is nothing you need to do.

If your domain is not registered with us

You will need to manually manage your DS records at your domain registrar.

How it works:

  1. When key rotation starts, we email you the new DS record in both DS-data and KEY-data format. The same values appear under on the tab while the rotation is in progress. At this point, your zone is signed by two sets of DNSSEC keys.
  2. Add the new DS record at your registrar within 30 days. Keep the old DS record in place for now.
  3. Once our system verifies the new DS record is published in the parent zone, we wait 24 hours for cached DS records to expire, then email you the key tag of the old DS record.
  4. Remove the old DS record at your registrar within 30 days.
  5. Once our system verifies the old DS record is no longer in the parent zone, we wait another 24 hours, remove the old key set, and the rotation is complete.

If you miss either deadline, we cancel the rotation. Your registrar’s documentation explains how to add and remove DS records there.

Tip

The 24-hour waits cover the TTL (Time-to-Live) of DS records, which is how long resolvers may cache the old ones. Don’t remove the old DS record before you get the second email, or some resolvers may fail to validate your domain.

Automating key rotation

If your domain registrar offers an API for managing DS records, you can automate the DS updates for domains registered outside DNSimple.

To do this, use the dnssec.rotation_start and dnssec.rotation_complete webhook events to trigger the updates.

For details, refer to our webhooks API documentation.

Learn more

To learn more about DNSSEC, see What Is DNSSEC?. For information about DS records and how they work, see What Are DS Records?. For step-by-step instructions on managing DS records, see Add and Remove DS Records. To understand TTL and how it affects DNS record propagation, see What Is Time-to-Live?. For a complete overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.

Have more questions?

If you have any questions or need assistance rotating DNSSEC keys, contact support, and we will be happy to help. You can also read more about DNS hosting at DNSimple.