OFFICIAL GUIDE

DNSSEC

Sign the zone, publish the DS at the registrar, and validate the chain.

DNSSEC is only validated end to end when the zone is signedandthe correct DS record is published in the parent by the registrar.

Enable DNSSEC in FiverPanelThe zone starts publishing DNSKEY and RRSIG signatures.

Copy the SHA-256 DSNormally use digest type 2 when supported by the registrar.

Register the DS at the registrarEnter Key Tag, Algorithm, Digest Type, and Digest exactly as provided.

Wait for the parent to publish itQuery the TLD directly or use a recursive resolver.

Confirm the AD flagA response validated by 1.1.1.1 or 8.8.8.8 should includead.

Validation commands

Terminal

dig @1.1.1.1 example.com DS +dnssec +noall +answer +comments
dig @1.1.1.1 example.com SOA +dnssec +comments
dig @8.8.8.8 example.com SOA +dnssec +comments

Success signalWhen the chain is correct, validating resolvers return the response with theadflag.

← PreviousDNS Records Next →DNS Cluster / DNSOnly