How to Enable and Manage DNSSEC, Including Key Rollovers (KSK/ZSK)

Enabling DNSSEC means signing your zone, publishing the right key material, and lodging a DS record with your registrar — then maintaining it by rolling keys safely over time. Done correctly it is robust; done carelessly it can take your domain offline, so the process matters. Start with what DNSSEC is for the concepts.

Two keys, two jobs

• ZSK (Zone Signing Key) — signs the actual records in your zone. It is used constantly, so it is typically smaller and rolled more often.
• KSK (Key Signing Key) — signs the DNSKEY record set (which contains the ZSK). It is the anchor of trust, rolled less often, and it is the KSK that the parent's DS record refers to.

Splitting the roles means you can rotate the busy ZSK without touching the registrar, and only involve the parent zone when rolling the KSK.

Enabling it

1. Turn on signing for the zone on your DNS platform, which generates the keys and RRSIG records.
2. Get the DS record (a digest of your KSK) from the platform.
3. Publish the DS at your registrar so the parent TLD vouches for your key, completing the chain of trust.
4. Verify with dig (look for the ad flag from a validating resolver).

Rolling the ZSK: pre-publish

To change the ZSK without a gap, use a pre-publish roll: add the new ZSK to the zone first (so resolvers cache it), then start signing with it, and only remove the old key after its signatures have aged out of caches. Nothing at the registrar changes.

Rolling the KSK: double-DS

Rolling the KSK involves the parent. The safe pattern is to publish the new DS alongside the old at the registrar, wait for it to be widely cached, switch to signing the DNSKEY set with the new KSK, then remove the old DS. Rushing this — removing the old key before caches expire — is what causes outages.

The golden rule: respect TTLs

Every rollover step must wait for old material to expire from caches before removing it. Never delete a key or DS that resolvers may still be relying on.

Frequently asked questions

What's the difference between KSK and ZSK?

The ZSK signs your zone's records; the KSK signs the key set and is what the parent's DS record points to. Separating them lets you roll the ZSK freely and only involve your registrar when rolling the KSK.

Why did my domain go SERVFAIL after a key change?

Almost always a rollover that removed old key material or DS before caches expired, breaking the chain for validating resolvers. Recovery means restoring consistency; prevention means respecting TTLs at every step.

Can my DNS provider automate rollovers?

Many do, handling ZSK rolls and even KSK rolls with automated DS updates where supported. Automation greatly reduces the risk, but you should still confirm the DS at your registrar matches after any KSK change.