Enable DNSSEC for a Domain in UltraDNS – UltraDNS Support

Overview

This article explains how to sign a domain's DNS zone in UltraDNS and provide the Delegation Signer (DS) records to your domain registrar. Your registrar is the company that manages your domain registration.

DNS Security Extensions (DNSSEC) uses digital signatures to help DNSSEC-validating resolvers check the authenticity of DNS responses.

Signing the zone in UltraDNS and publishing its DS records through your registrar are separate steps. The DS records connect the signed zone to the DNSSEC chain of trust.

When to Use This Article

Use this article when you want to enable DNSSEC for a domain managed in UltraDNS.

Before You Begin

Have access to the domain in UltraDNS and permission to sign its zone.
Have access to your registrar's DS record management process, or contact someone who can submit the DS records for you.
UltraDNS recommends a minimum time to live (TTL) of 300 seconds (5 minutes) for DNSSEC-enabled zones.

Steps

Log in to UltraDNS.
Click Domains.
Select the domain you want to enable DNSSEC for.
Click the DNSSEC tab, located to the right of the Records tab.

If the DNSSEC tab is missing, contact Customer Support to request DNSSEC access and confirm the required account permissions.
Under Zone Status, click Sign.

UltraDNS queues the signing request and creates the RRSIG, DS, and DNSKEY records.

The optional Change Comment field allows you to describe the action. The comment appears in the Audit Log.
Wait for the signing process to complete. The DNSSEC Policies, Key Signing Key (KSK), DS Resource Records, and Zone Signing Key (ZSK) sections populate when signing is complete.

The zone is now signed in UltraDNS. Complete the registrar step below to establish the parent DS connection.
Provide the DS records displayed under DS Resource Records to your registrar. Ask the registrar to publish the records in the parent zone through the appropriate registry.

Verify the Configuration

Confirm that the DNSSEC policy, key, and DS record sections are populated in UltraDNS.
Confirm with your registrar that the submitted DS records have been published and match the values displayed in UltraDNS.

The populated sections confirm that UltraDNS has completed zone signing. They do not confirm that your registrar has published the DS records.

Expected Outcome

UltraDNS signs the zone, and your registrar publishes the corresponding DS records in the parent zone. With a valid DNSSEC chain of trust, DNSSEC-validating resolvers can authenticate the zone's signed DNS data.

Important Notes

ZSK rollover: UltraDNS manages automatic Zone Signing Key rollover. The documented default frequency is 30 days, and the frequency can be configured in the account's DNSSEC Settings.
Signature validity: RRSIG validity is a separate setting from ZSK rollover frequency. The documented default RRSIG validity is 14 days.
DS records and expiration: DS records do not contain a signature expiration date. RRSIG records contain the signature validity dates.
KSK rollover: You can request a Key Signing Key rollover using the KSK Rollover button. A KSK rollover requires you to submit the new DS records to your registrar.

Related to