Enable DNSSEC and manage registrar DS records from Blesta
PD DNS Manager offers DNSSEC controls where the selected backend supports them. Signing the zone and publishing its DS record at the registrar are separate parts of establishing a working chain of trust.
Before a change, confirm the provider connection and the actual zone it resolves. With Route 53, name-based operations resolve the first matching hosted-zone name; selecting a familiar domain is not sufficient when AWS holds multiple zones with that name. Have your AWS administrator compare the hosted-zone ID, records and assigned nameservers before proceeding. With Google Cloud DNS, the current connection derives the managed-zone name from the domain. An existing zone with a different native name can appear in a list yet fail to open correctly; establish that mapping with your Google Cloud administrator instead of creating a duplicate zone.
Check support and authority
Open DNS → Zones, select the intended zone and use its available DNSSEC control/page. Review the provider and authoritative nameservers. Do not interpret a missing control or a dash in a list as proof that the domain is unsigned everywhere.
Support depends on the backend. For example, deSEC signs zones at the provider automatically and is not offered as a manual signing toggle in the module. Ask the provider for the correct signing material where that is required.
Enable and complete the chain
- Confirm the zone and registrar account you intend to change.
- Enable signing through the available Enable DNSSEC action.
- Copy the resulting DS fields exactly from the DNSSEC page.
- Publish those DS values through the domain’s registrar.
- Check the parent DS, child signing and public validating DNS response together.
Do not create a DS record in an unrelated part of your ordinary zone as a substitute for the parent/registrar step. Keep algorithm, digest type, key tag and digest paired with the correct zone and provider.
Roll back in the correct order
If disabling signing, remove the parent/registrar DS first. Keep the old zone signed while that DS can still be cached; allow its TTL to expire before disabling the zone’s signing. Leaving a cached parent DS that points to an unsigned or different key can break validating DNS resolution.
Cloudflare’s DNSSEC rollback guidance explains this order for its service. Use the registrar/provider’s corresponding procedure for the backend you operate.
Diagnose without repeated toggling
A refused enable action can mean provider permissions or client policy. A validating lookup failure can instead mean mismatched DS material, stale parent data or delegation. Preserve the exact redacted error and signing state for support. Before changing provider, follow the signed-zone migration procedure and do not assume keys move with the records.
See the PD DNS Manager Blesta guide for related tasks, or explore the module.
