# Set up DNSSEC

> Read a zone's DNSSEC status and DS records on its Settings tab, and publish the DS record at the domain's registrar.

Source: https://www.coritan.com/docs/websites/dns/dnssec/

In the dashboard:

- /dashboard/websites/…/settings: https://www.coritan.com/dashboard/websites

DNSSEC signs a zone's answers so that resolvers can check they came from the zone's nameservers unchanged. Coritan signs every zone it hosts from the moment you add it. Resolvers check the signatures once the domain's registry publishes the zone's *DS records*, which you add at the domain's registrar.

A free Coritan name, such as `survival-smp.coritan.gg`, needs no step from you: Coritan publishes its DS records in `coritan.gg` when you claim it.

## How Coritan signs a zone

Coritan signs with algorithm 13, `ECDSAP256SHA256`, and two keys:

*Key-signing key* (KSK)
: Signs the zone's keys. The DS records are made from it, so they stay the same for as long as the zone keeps this key.

*Zone-signing key* (ZSK)
: Signs the zone's records. Coritan replaces it on a schedule, which needs no change at the registrar.

The domain's **Settings** tab shows the zone's **Algorithm**, **KSK key tag**, **ZSK key tag** and **Last ZSK rotation** on the **DNSSEC** card.

## Before you begin

- The domain's DNS must be hosted on Coritan, and the domain must use Coritan's nameservers at its registrar ([Add a domain you already own](/docs/websites/add-an-existing-domain/)).
- You need to be able to change the domain's DNSSEC settings at its registrar.

> [!IMPORTANT]
> If the domain had DNSSEC at your previous DNS provider, delete that provider's DS records at the registrar before you move the domain to Coritan's nameservers. A DS record that does not match the zone's key makes validating resolvers refuse every answer for the domain.

## Publish the DS record at your registrar

1. In the dashboard, go to [Websites](https://www.coritan.com/dashboard/websites), open the domain and select the **Settings** tab.
2. Check that the **DNSSEC** card shows the zone as enabled.
3. On the **DS records for the registrar** card, copy the records. Each one reads like this, with the key tag, the algorithm, the digest type and the digest after `DS`:

   ```dns
   example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…
   example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…
   ```

4. At your registrar, open the domain's DNSSEC settings and add a DS record with the values from the first record: key tag `2371`, algorithm `13`, digest type `2` (SHA-256) and the digest. If the registrar accepts digest type `4` (SHA-384), you can add the second record as well.
5. Save the change at the registrar.

For a domain registered with Coritan, the dashboard has no way to send DS records to the registry, so resolvers treat the zone as unsigned and do not check its signatures. [Contact support](/docs/support/) if you need DNSSEC validated for such a domain.

## Result

Once the registry publishes the DS record, validating resolvers check every answer from the zone. The registry publishes changes on its own schedule. Check from a terminal that the DS record is live and that a validating resolver accepts the zone's answers:

```bash
dig example.com DS +short
dig @1.1.1.1 example.com A +dnssec
```

The second command's flags include `ad` when the resolver has checked the signatures.

## Troubleshooting

`SERVFAIL` from validating resolvers
: The DS record at the registrar does not match the zone's key. Compare it with the **DS records for the registrar** card, and delete any DS record left by a previous DNS provider.

`Signing is off for this zone.`
: The zone is not signed, so it has no DS records to publish. [Contact support](/docs/support/) to turn signing on.

The DS records on the card have changed
: The zone has a new key-signing key. Replace the DS records at your registrar with the new ones straight away, because validating resolvers refuse the zone's answers until the two match.

## Related

- [How DNS hosting works](/docs/websites/dns/)
- [Change a domain's nameservers](/docs/websites/domains/change-nameservers/)
- [Delete a DNS zone](/docs/websites/dns/delete-a-dns-zone/)

## With the API

Read a zone's DNSSEC status and DS records:

```bash
curl https://api.coritan.com/api/v1/dns/zones/42/dnssec \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "enabled": true,
  "algorithm": "ECDSAP256SHA256",
  "ksk_key_tag": 2371,
  "zsk_key_tag": 40125,
  "ds_records": [
    "example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…",
    "example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…"
  ],
  "zsk_rotated_at": "2026-09-20T03:00:00Z"
}
```

`ds_records` is empty when `enabled` is `false`. `zsk_rotated_at` is `null` until Coritan first replaces the zone-signing key.

## API

- `GET /api/v1/dns/zones/{zone_id}/dnssec`: Get DNSSEC info (https://www.coritan.com/docs/api/reference/client/dns/#op-get-api-v1-dns-zones-zone-id-dnssec)