This article explains how to safely update DNS records for a domain that already has DNSSEC enabled in UltraDNS.
It applies when modifying DNS configuration while maintaining DNSSEC validation.
When to Use This Article
- Your domain has DNSSEC enabled.
- You need to modify DNS records in the signed zone.
- You want to avoid DNSSEC validation errors during updates.
How DNSSEC Affects Zone Updates
When DNSSEC is enabled, the zone is cryptographically signed.
Any changes to DNS records require the zone to be re-signed so that the digital signatures reflect the updated data.
UltraDNS automatically handles the signing process when records are added, edited, or deleted in a DNSSEC-enabled zone.
How to Update Records in a DNSSEC-Enabled Domain
- Log in to the UltraDNS portal.
- Navigate to the DNSSEC-enabled domain.
- Make the required DNS record changes.
- Save the changes.
- Allow the system to automatically re-sign the zone.
Verification
After making changes, confirm that DNS resolution works correctly and that DNSSEC validation succeeds using external DNSSEC validation tools.
Ensure that no SERVFAIL or validation errors occur.
Important Notes
- UltraDNS automatically re-signs the zone after record updates.
- Registrar DS records must remain accurate and aligned with the current DNSKEY data.
- Propagation timing may affect when changes appear publicly.