PD Cloudflare DNS can enable zone signing and show the DS details needed by your domain registrar. Complete both sides of the chain of trust; a signing switch alone does not prove the parent delegation is correct.

Prepare the domain

Confirm the authoritative nameservers and the registrar currently managing the domain. If moving from another DNS provider, review existing DS records before changing delegation. A stale DS entry for an old signing setup can cause validation failures.

Clients need an editable assigned zone. A zone lock or domain-only view/hidden policy can intentionally prevent client DNSSEC changes.

Enable signing and complete delegation

1. Open the intended zone through Cloudflare DNS → Zones → Records, or through the module’s enabled DNS Manager client-menu entry, or My Tools and its DNS page in the client area.
2. Open DNSSEC and choose Enable DNSSEC.
3. Copy the displayed DS record details for this exact zone.
4. At an external registrar, add the DS details using its DNSSEC procedure. If the registrar manages that step automatically, follow its documented workflow.
5. Verify the registrar/parent DS data matches the current zone and check DNSSEC status after the relevant DNS caches refresh.

Do not publish the registrar’s DS only as an ordinary record inside the same zone and assume the parent delegation changed. DNSSEC signing also does not encrypt web traffic or replace a website’s HTTPS certificate.

Disable in the correct order

Remove the DS at the registrar first and keep zone signing enabled until its parent-zone TTL has expired. Then disable signing through the zone’s DNSSEC control. Cloudflare documents this DNSSEC rollback order.

Do not repeatedly toggle signing to investigate an unexplained resolver failure. Your hosting team and DNS administrator should compare the authoritative nameservers, current DS/signing state and original error before changing either side again.

Diagnose a failure

A validation failure such as SERVFAIL can result from mismatched delegation, while a refused API action can be a token or policy problem. Use the exact error and current registrar state to distinguish them. Keep DNS changes and registrar changes coordinated during recovery.

Check signing and delegation

Your hosting team and DNS administrator should compare the original signing action/result, current Cloudflare signing state and displayed DS material with the actual registrar and parent DS data. Zone signing, registrar acceptance and cached validation are separate results. Follow the rollback order above rather than repeatedly toggling signing to diagnose SERVFAIL.

See the PD Cloudflare DNS Blesta guide for related tasks, or explore the module.