Use PD PowerDNS to request zone signing, then publish the corresponding DS at the registrar or parent. Signing the zone and completing the public chain of trust are separate steps.

Prepare the zone and parent

Confirm the intended editable zone, authoritative nameservers and registrar. Ask the PowerDNS administrator to confirm that its backend supports the signing operation. Do not use signing controls as a repair for an unrelated delegation or connection error.

Enable and publish

1. Open PowerDNS → Zones, select the zone and open DNSSEC.
2. If the zone is not signed, choose Enable DNSSEC and inspect the result.
3. Review the current signing status and the displayed DS material.
4. Add the correct DS at the registrar or parent using its supported workflow.
5. Check the parent publication and a public validating DNS response.

A DS normally contains key tag, algorithm, digest type and digest, or can be supplied as the complete DS text where accepted. Some parents ask for DNSKEY material instead; follow their required format without confusing DNSKEY flags with DS fields.

The upstream PowerDNS DNSSEC guide explains parent publication. The module’s status indicator alone does not establish that the whole chain validates.

Keep key administration separate

PowerDNS manages the signing keys. A record snapshot does not preserve secret signing keys or recreate a parent trust chain. Server-side rollover and backend preparation remain the administrator’s work.

If signing is refused, retain the original redacted result while your hosting team’s PowerDNS administrator checks the current signing/key state and backend requirements rather than changing server configuration blindly. Use the safe disabling guide before removing signing from an already delegated signed zone.

Check signing and parent DS publication

Your hosting team and PowerDNS administrator should compare the intended editable zone, original enable result, actual current keys/signing state and displayed DS with authoritative signed answers. Enabling creates a key before the follow-up rectification step; a failure at the later step is not proof that no key was created. Inspect actual state before enabling again. Check registrar/parent publication and public validation separately from the module status. Do not publish guessed DS material.

See the PD PowerDNS WHMCS guide for related tasks, or explore PD PowerDNS.