DNSSEC

Table of Contents

• DNSSEC Scenarios
• Managing DNSSEC
• Enable DNSSEC
• Disable DNSSEC
• Key Rotation
• Troubleshooting DNSSEC configurations

DNSSEC provides a way to cryptographically build a chain of trust from the root name servers all the way through to authoritative name servers. Authenticating resolvers may then verify this chain of trust to ensure the DNS results were not tampered with while in transit.

DNSSEC Scenarios

We currently support DNSSEC in the following ways:

• If your domain is registered through DNSimple and you are using our authoritative name servers, then you may sign zones and insertion and rotation of your DS record is handled automatically.
• If your domain is registered through DNSimple but host your DNS with another authoritative DNS provider, then you may add DS records for DNSSEC-enabled zones.
• If your domain DNS is hosted through DNSimple, but your domain is registered elsewhere, then you may sign zones in our name servers, but you will be required to handle the creation and rotation of DS records.

We do not support DNSSEC for zones using secondary DNS at this time.

Managing DNSSEC

DNSSEC is applied on a per-domain basis. You may manage DNSSEC by going to a domain’s management page and using the DNSSEC tab.

Enable DNSSEC

To enable DNSSEC, click on the “Configure DNSSEC” link once you’re on the DNSSEC management page for a domain.

Then click on the “Enable DNSSEC” button.

If your domain is registered with DNSimple, and using our name servers, then the zone will be signed and the DS record will be created in the appropriate domain registry.

If your domain is registered with us but delegated elsewhere, then you will need to provide the DS record information from your DNS provider.

Disable DNSSEC

Warning: If your domain is registered with another domain registrar, then you should remove the DS record from that registrar before removing the zone signing from DNSimple.

To disable DNSSEC, go to the DNSSEC tab for the domain, and click on the Configure DNSSEC link again.

Click on the Delete DNSSEC Configuration button to remove the zone signing and the DS record if it is present.

Key Rotation

DNSimple currently rotates both key signing keys and zone signing keys every 90 days.

As stated above, if your domain is both registered with us and uses our authoritative name servers, then we will handle rotation of keys automatically. If not, then you will receive an email notification whenever key rotation starts, with the new DS record, which you will need add through your domain registrar.

Warning: please consider carefully whether you are able and willing to rotate DS records at your registrar if your domain is not registered with DNSimple. It is essential that DS records are updated whenever DNSSEC keys are rotated in your DNSimple zone. If you do not update your DS record when your keys change, then your domain will fail to resolve through resolvers that verify DNSSEC keys, including Google’s Public DNS. This will result in failed DNS resolution for your domains.

Troubleshooting DNSSEC configurations

The following tools may be helpful in troubleshooting DNSSEC configuration issues:

• Verisign DNSSEC Debugger
• DNSViz

You may also contact DNSimple support if you have additional questions.