Set up DNSSEC

DNSSEC signs a zone's answers so that resolvers can check they came from the zone's nameservers unchanged. Coritan signs every zone it hosts from the moment you add it, and you can switch signing off and on again on the domain's Settings tab. Resolvers check the signatures once the domain's registry publishes the zone's DS records, which you add at the domain's registrar.

A free Coritan name, such as survival-smp.coritan.gg, needs no step from you: Coritan publishes its DS records in coritan.gg when you claim it, and DNSSEC stays on for it.

Coritan signs with algorithm 13, ECDSAP256SHA256, and two keys:

Key-signing key (KSK)

Signs the zone's keys. The DS records are made from it, so they stay the same for as long as the zone keeps this key.

Zone-signing key (ZSK)

Signs the zone's records. Coritan replaces it on a schedule, which needs no change at the registrar.

Each signature is valid for 14 days. Coritan signs the records again soon after a third of that time has passed.

The domain's Settings tab shows the zone's Algorithm, KSK key tag, ZSK key tag and Last ZSK rotation on the DNSSEC card.

• The domain's DNS must be hosted on Coritan, and the domain must use Coritan's nameservers at its registrar (Add a domain you already own).
• You need to be able to change the domain's DNSSEC settings at its registrar.

1. In the dashboard, go to Domain Management, open the domain and select the Settings tab.

2. Check that the DNSSEC switch on the DNSSEC card is on. If it is off, switch it on.

3. On the DS records for the registrar card, copy the records. Each one reads like this, with the key tag, the algorithm, the digest type and the digest after DS:

   DNS

   example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…
   example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…
   

4. At your registrar, open the domain's DNSSEC settings and add a DS record with the values from the first record: key tag 2371, algorithm 13, digest type 2 (SHA-256) and the digest. If the registrar accepts digest type 4 (SHA-384), you can add the second record as well.

5. Save the change at the registrar.

For a domain registered with Coritan, the dashboard has no way to send DS records to the registry, so resolvers treat the zone as unsigned and do not check its signatures. Contact support if you need DNSSEC validated for such a domain.

1. At the domain's registrar, delete its DS records, then wait a day so that resolvers drop the copies they hold.
2. In the dashboard, go to Domain Management, open the domain and select the Settings tab.
3. On the DNSSEC card, switch DNSSEC off.
4. Select Turn off DNSSEC to confirm.

The dashboard confirms DNSSEC turned off for example.com., and the card reads DNSSEC is off, so resolvers treat example.com as unsigned. Coritan keeps the zone's keys. When you switch DNSSEC on again, the zone is signed with the same key-signing key, so the DS records for the registrar card lists the same records as before.

The switch stays on for a free name, such as survival-smp.coritan.gg, because Coritan publishes its DS records in coritan.gg.

Once the registry publishes the DS record, validating resolvers check every answer from the zone. The registry publishes changes on its own schedule. Check from a terminal that the DS record is live and that a validating resolver accepts the zone's answers:

dig example.com DS +short
dig @1.1.1.1 example.com A +dnssec

The second command's flags include ad when the resolver has checked the signatures.

SERVFAIL from validating resolvers

The DS record at the registrar does not match the zone's key, or the zone is not signed while the registry still lists a DS record. Compare the record with the DS records for the registrar card, delete any DS record left by a previous DNS provider, and check that the DNSSEC switch is on.

The DNSSEC card says DNSSEC is off

The zone is not signed, so it has no DS records to publish. Switch DNSSEC on, then publish the records that the DS records for the registrar card lists.

Too many requests for this action. Try again later.

A zone takes 10 DNSSEC switches in an hour. Wait an hour and try again.

The DS records on the card have changed

The zone has a new key-signing key. Replace the DS records at your registrar with the new ones straight away, because validating resolvers refuse the zone's answers until the two match.

• How DNS hosting works
• Change a domain's nameservers
• Website settings
• Delete a DNS zone

Read a zone's DNSSEC status and DS records:

curl https://api.coritan.com/api/v1/dns/zones/42/dnssec \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "enabled": true,
  "algorithm": "ECDSAP256SHA256",
  "ksk_key_tag": 2371,
  "zsk_key_tag": 40125,
  "ds_records": [
    "example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…",
    "example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…"
  ],
  "zsk_rotated_at": "2026-09-20T03:00:00Z"
}

ds_records is empty when enabled is false. zsk_rotated_at is null until Coritan first replaces the zone-signing key.

Switch DNSSEC off or on with dnssec_enabled:

curl -X PATCH https://api.coritan.com/api/v1/dns/zones/42 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"dnssec_enabled": false}'

The answer is the zone, with dnssec_enabled as saved. Sending the state the zone already has changes nothing. After 10 switches in an hour on one zone, the call answers 429 with a Retry-After header. For a free name, false answers 409 with DNSSEC stays on for survival-smp.coritan.gg, because we publish its DS records in coritan.gg.