Configuring DNSSEC

DNS Security Extensions(DNSSEC) is designed to protect Internet resolvers from forged DNS to prevent DNS tampering. 

Your DNS provider supplies the DNSSEC values that you enter for your domains. OpenSRS does not do any DNSSEC validation, and we pass the DNSSEC values on to the registry.

Important: If SystemDNS nameservers are being used, DNSSEC is not supported.

What to know before adding DNSSEC

DNSSEC works by digitally signing the DNS records at the authoritative DNS server. A DNS resolver knows whether the information it receives is identical to the authoritative DNS server's information by checking the digital signature. This attests to the address's validity and ensures that the site you visit is the one you intended to go to rather than a site where your personal information could be compromised. If the DNS cannot be authenticated, your browser won't display the site.

For domains being transferred in, DNSSEC records will be maintained and carried over to OpenSRS. You can request the DNSSEC to be removed if you do not want to maintain it upon transferring the domain to us. Please contact support to request DNSSEC removal.

DNSSEC is not supported for all TLDs. You can find the list of DNSSEC-enabled TLDs in our TLD reference chart. There is no cost associated with adding, changing, or removing public key material (e.g., DNSKEY or DS resource records) for supported TLDs. For TLDs where we do not currently support DNSSEC, there will be a $500 USD fee for adding or changing a DNSSEC key. There is no cost for removing a DNSSEC record.

Note: You cannot assign DNSSEC values to the domain at the time of registration, but once the domain is registered, you can modify it and add the DNSSEC values. 

Allowed values

Key Tag

An integer value is used to identify the DNSSEC record. Value cannot be more than 65535.

Algorithm Type The cryptographic algorithm that generates the signature. Allowed values are:
  • 2    Diffie-Hellman
  • 3    DSA/SHA-1
  • 5    RSA/SHA-1
  • 6    DSA-NSEC3/SHA1
  • 7    RSASHA1-NSEC3/SHA1
  • 8    RSA/SHA-256
  • 10  RSA/SHA-512
  • 13  ECDSA Curve P-256 with SHA-256
  • 14  ECDSA Curve P-384 with SHA-384
  • 253    Private [PRIVATEDNS]
  • 254    Private [PRIVATEOID]
Digest Type

The algorithm type that constructs the digest.  Allowed values are:

  • 1    SHA-1
  • 2    SHA-256
  • 3    GOST
  • 4    SHA-384
Digest

The digest is an alpha-numeric string value.  The length depends on the digest type used. Allowed values are: 

SHA-1: 40 characters

SHA-256 and GOST: 64 characters

SHA-384: 96 characters

Back to top

Adding in the RCP

  1. Log in to the Reseller Control Panel.
  2. Click Domains.
    DNSSEC_RCP_1.png

  3. Filter/search and click on the domain name you would like to add DNSSEC.
    DNSSEC_2.png

  4. Scroll down to the DNSSEC section and click Edit.
    DNSSEC_3.png

  5. Complete the four fields with information obtained from the DNS provider and click Save

    DNSSEC_5.png

Modifying and removing in the RCP

  1. Log in to the Reseller Control Panel.
  2. Click Domains.
    DNSSEC_RCP_1.png
  3. Filter/search and click on the domain name you would like to modify or remove DNSSEC.
    DNSSEC_2.png
  4. To modify, change the information you wish to update and click Save.DNSSEC_5.png
  5. To delete, click the red - sign next to the record and click Save.
    DNSSEC_6.png

Adding in the MWI

  1. Log in to the Manage web interface (MWI), aka the end-user portal with the domain for you would like to add DNSSEC.
  2. Click Name Servers.
    DNSSEC_MWI_1.png
  3. Scroll to the bottom and select Configure DNSSEC.
    DNSSEC_MWI_2.png
  4. Enter the information supplied by your DNS provider and click Save DS Record
    DNSSEC_MWI_3.png

Modifying and removing in the MWI

  1. Log in to the Manage web interface (MWI), aka the end-user portal with the domain for you would like to add DNSSEC.
  2. Click Name Servers.
    DNSSEC_MWI_1.png
  3. Scroll to the bottom and select Configure DNSSEC.
    DNSSEC_MWI_2.png
  4. To modify, change the information you wish to update and click Save DS Records.DNSSEC_MWI_4.png

  5. To delete, click Remove next to the record and click Save DS Record.
    DNSSEC_MWI_4.png

Configure DNSSEC in the API

Below are some quick links to our API XML guide for commands relevant to configuring DNSSEC.

modify(DNSSEC)
get(DNSSEC)
set_dnssec_info

Back to top

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.