DNSSEC
Sign a hosted zone and publish DS at your registrar
Manage DNSSEC on a hosted zone at /organization/dns → open the zone → DNSSEC (?t=dnssec).
DNSSEC lets resolvers verify that answers for your domain come from NodeRings and were not altered. You enable signing in NodeRings, then paste a DS record at the registrar (the same place you set nameservers).
Do this after nameservers already point at NodeRings and the zone is Active. If you still have DS from a previous DNS host, remove that DS before changing nameservers — see DNS.
Enable DNSSEC
Sign the zone
On the DNSSEC tab, click Enable DNSSEC. Signing uses algorithm 13 (ECDSA P-256) and NSEC3.
Copy DS
Copy the DS record NodeRings shows. You can also copy DNSKEY if your registrar asks for it instead of DS.
Publish DS at the registrar
Add that DS (or DNSKEY) in the registrar’s DNSSEC / DS settings. Save. Propagation can take minutes to hours.
Confirm
Click Check parent DS. When NodeRings can see DS at the parent, status becomes Signed (DS at parent).
| Status | Meaning |
|---|---|
| Unsigned | DNSSEC is off |
| Signed (add DS at registrar) | Zone is signed; parent still has no DS |
| Signed (DS at parent) | DS is visible at the registrar / parent zone |
Disable DNSSEC
Remove DS at the registrar first
Delete the DS (and DNSKEY if you added it) at the registrar. Wait until it is gone.
Disable in NodeRings
On the DNSSEC tab, click Disable DNSSEC.
Do not disable signing in NodeRings while DS is still at the parent. Validating resolvers will SERVFAIL. Use Force disable even if DS is still at the parent only if you understand that risk (for example you already removed DS but the check still lags).
Deleting a zone with DNSSEC still active has the same rule: remove DS at the registrar first, or confirm force-delete in Settings.