Overview
A Key Signing Key (KSK) rollover replaces the KSK used for a DNSSEC-signed domain. This procedure explains how to start the rollover in UltraDNS and update the corresponding Delegation Signer (DS) records through your domain registrar.
Starting the rollover in UltraDNS does not complete the registrar update. You must provide the new DS records to your registrar.
When to Use This Article
Use this procedure when you need to perform a KSK rollover for a domain that already has DNSSEC enabled in UltraDNS.
Before You Begin
- Confirm that you can access the domain's DNSSEC tab in UltraDNS.
- Confirm that you can update DS records through your domain registrar, or contact someone who can make that change.
- Plan to provide the new DS records to your registrar as soon as possible after starting the rollover.
Important: An incorrectly managed KSK rollover or a delayed DS record update can cause DNSSEC validation failures and prevent users from resolving your domain.
Start the KSK Rollover
- Log in to UltraDNS.
- Click Domains.
- Select the domain that requires the KSK rollover.
- Click DNSSEC.
Click ROLLOVER.
UltraDNS generates a new KSK and provides the corresponding DS records.
- Copy the new DS records provided by UltraDNS.
Update the DS Records Through Your Registrar
- Provide the new DS records to your domain registrar.
- Have your registrar replace the existing DS records with the new DS records.
- Confirm with your registrar that the DS record update has been completed.
UltraDNS maintains both the old and new KSKs during a transition period to support DNSSEC validation while DNS resolvers update their cached information.
Expected Outcome
The registrar has updated the DS records to correspond to the new KSK generated by UltraDNS.
The existing KSK rollover article states that UltraDNS automatically detects the DS record changes and removes the old keys after the update has propagated.
Important Notes
- Keeping both KSKs during the transition does not provide an unconditional guarantee of uninterrupted DNS resolution. The DS record update must also be completed correctly.
- The supplied procedure does not specify a completion time or a portal indicator that confirms the rollover has finished.