Manage signing and its parent DS relationship in Plesk and at the registrar or parent operator. PD Plesk DNS manages supported ordinary records; it does not sign zones, retrieve signing keys or operate DNSSEC controls for this provider.

Prepare the native signing workflow

Ask the responsible administrator to confirm that the Plesk server supports DNSSEC and that the required extension and DNS service are available. Plesk’s DNSSEC guide describes signing, public key material and rollover responsibilities.

1. Identify the intended native domain and authoritative nameservers.
2. Use Plesk’s supported signing workflow for that domain.
3. Obtain the current public DS information from Plesk.
4. Submit the intended DS through the registrar or parent’s supported process.
5. Check the actual public validation chain and normal DNS resolution.

An ordinary DNS record save or a passed provider connection test does not prove the domain is correctly signed. Do not add a parent DS as an ordinary TXT record in the child zone.

Continue ordinary record management

You can manage the module’s supported A, AAAA, CNAME, MX, TXT and NS records while native Plesk manages signing. Check authoritative answers and validation after important changes. Signing private keys are not part of a BIND record export from the module.

Handle rollover or removal separately

Keep parent DS information aligned with the native signing keys during rollover. Before turning off signing, coordinate removal of the parent DS and allow its previous cached dependency to expire using the responsible DNS operator’s process.

If resolution fails, preserve the domain, action time and redacted validation result. Ask the responsible administrator to inspect native signing and parent state; recreating ordinary records or changing module permissions cannot repair an inconsistent signing chain.

See the PD Plesk DNS Blesta guide for related tasks, or explore the module.