DNSSEC
Sign your DNS zone and register a DS record with the parent zone.
DNSSEC signs DNS responses, which prevents them from being tampered with in transit.
How to turn it on
- Turn on DNSSEC for the zone on the dashboard. The zone starts signing (
Signing). - Once signing has finished, the DS value appears (
DS pending). - Register the DS record with the parent zone at your registrar.
- Once the DS record resolves in the parent zone, the status changes to
Protected.
For domains purchased through runlot, step 3 is handled automatically. For domains bought at another registrar, register the DS values shown to you with that registrar yourself.
Key rollover
Keys are rotated periodically. The new DS record has to be registered before the old key is removed; doing it in the wrong order can break domain resolution. runlot handles this ordering automatically.
Turning it off
To disable DNSSEC, the DS record is removed from the parent zone first, we wait for propagation, and then signing stops. This ordering is handled automatically.
Where to check
The zone's DNS screen on the dashboard shows the signing state and the DS value to register. If publishing stalls, the organization's admin receives a dns_publish_stalled notification.