Enable DNSSEC for KeyDNS zones

• Zone is not existing in KeyDNS: Add the DNS zone to KeyDNS with the command AddDNSZone. To enable DNSSEC support, add the parameter 'signed=1' to the AddDNSZone command.
• Zone is already existing in KeyDNS: Use the command ModifyDNSZone with the additional parameter 'signed=1' to enable DNS support for your existing DNS zone. You can set signed=0 to disable DNSSEC support of a DNSSEC enabled zone. Please ensure in this case, that the delegation signer in the parent zone is not present anymore.
  • Sign the zone
  • After DNS changes have been propagated, update the parent zone. The information can be obtained by the StatusDNSZone command. Please always use the KSK (flag: 257) to update the parent zone

Key rollover

KeyDNS DNSSEC supports two kinds of key rollovers:

• Zone signing key (ZSK) rollover
  • Can be manually initiated with the ModifyDNSZone command parameter: rollover=ZSK.
  • The ZSK rollover is finished automatically.
  • The ZSK being rolled automatically every month.
• Key signing key (KSK) rollover
  • Needs interaction with the parent zone.
  • Can be manually initiated with the ModifyDNSZone command parameter: rollover=KSK.
  • Can be finished (after parent zone update) with the parameter:finishkskrollover=<keytag>. The <keytag> defines the dnssec key whose rollover should be finished. The relevant keytag is returned by the command StatusDNSZone as the first part of the 'keydsdata sha256' parameter (where keydata flag: 257, keystatus: ready).
  • The first KSK rollover of a newly added DNSSEC zone can be initiated after the KSK key status has changed to 'active'.
  • The KSK is not being rolled automatically.

Only one ZSK and one KSK rollover can be active at the same time. To update the domain name with the relevant keydata or DS (delegation signer) data, please follow the CentralNic Reseller manual. Please use always the KSK (flag: 257) and not the ZSK for updating the parent zone.

DNSSEC policy

Signatures:

• Refresh: 4-daily
• Validity: 14 days
  

Denial of non existence

• NSEC3

Keys

• KSK: Algorithm 8, Length: 4096
• ZSK: Algorithm 8, Length: 2048

DNSSEC capable name servers

*All Servers are DNSSEC capable.*

Overview about the infrastructure can be found here:

Unicast - https://kb.centralnicreseller.com/dns/keydns/the-unicast-infrastructure

Anycast - https://kb.centralnicreseller.com/dns/keydns/the-anycast-infrastructure