Skip to documentation
Interneting.orgDocs
Interneting.orgDocs

Documentation

DNSSEC

Enable, publish and verify DNSSEC for supported authoritative zones.

DNSSEC adds signed DNS responses but also introduces a registrar-side dependency. Do not enable it casually on a production zone without understanding the DS-record step.

Typical flow

  1. Make sure the unsigned zone resolves correctly.
  2. Enable DNSSEC in Control.
  3. Wait for Control to report the zone signing material it needs you to publish.
  4. Add the DS record at the domain registrar or parent zone.
  5. Verify delegation and signing from outside the server.

When disabling DNSSEC, remove or update the parent DS record in the correct order so the domain does not become validation-broken.

Cloudflare-managed DNSSEC follows Cloudflare's provider lifecycle rather than native BIND key handling.