Use the zone’s DNSSEC control when the DirectAdmin server and account support signing, then publish the current DS at the registrar or parent. Keys displayed in the module are not by themselves proof of a valid public signing chain.

Prepare the signing arrangement

Confirm the correct domain, account context, authoritative servers and registrar. Ask the server administrator to confirm signing is enabled and permitted on this installation. The login key must allow the required DNS-management operations; a domain-list test does not prove them.

Enable and publish

1. Open DirectAdmin DNS → Zones, select the domain and open DNSSEC.
2. If appropriate, choose Enable DNSSEC and inspect the result.
3. Review the current DS material in the signing panel.
4. Publish the correct DS through the registrar or parent’s supported process.
5. Confirm parent publication and public validating DNS answers.

The module requests key generation and signing. Its status read is based on returned key material, so verify actual current signing and validation with the responsible administrator, especially after a refused or partial operation. Do not repeatedly generate keys as a repair for a parent/delegation mismatch.

Keep secret keys and recovery separate

The server manages signing keys. A BIND record snapshot does not preserve secret keys or recreate registrar trust. Use the registrar’s requested DS format and current material, not a stale screenshot.

If signing or key retrieval fails, retain the original redacted result, domain reference and action time while your hosting team checks the account and actual signing state. Use the safe disabling guide before removing signing from a zone with an existing parent DS.

Check signing and delegation

Your hosting team should compare the chosen zone/provider, actual signing result and current DS material with the intended authoritative nameservers and parent publication. Have your DirectAdmin administrator confirm that signing is enabled and permitted for the intended account and that the login key allows the operation; parent DS publication belongs with the registrar or DNS administrator. Returned key material is not a complete public chain-of-trust test, and a record snapshot does not preserve signing private keys.

See the PD DirectAdmin DNS Blesta guide for related tasks, or explore the module.