AWS Route 53 supports DNSSEC signing, but the released PD AWS Route 53 DNS module does not configure that signing workflow. A missing DNSSEC control in the module is therefore not proof that the AWS account is broken or needs a broader token.

Separate DNS records from signing

The module can manage its supported ordinary DNS record types. Route 53 zone signing additionally involves key-signing keys, AWS KMS and the parent/registrar chain of trust. Creating an ordinary DS record is not a substitute for configuring the zone’s signing and publishing the correct DS at its parent.

Use AWS’s Route 53 DNSSEC signing guide for that provider-side procedure. Assign it to the administrator responsible for the AWS signing keys and registrar changes rather than looking for an unsupported module button.

Check an existing signed domain

1. Identify the exact authoritative hosted zone and registrar.
2. Check signing/key state through the supported AWS workflow.
3. Compare the registrar/parent DS with the zone’s current signing material.
4. Check a public validating DNS response separately from an ordinary module connection test.
5. Preserve the provider and validation error for diagnosis.

A module zone-list status is not enough to establish that the full chain validates. If the domain returns a validation failure, investigate the delegation and parent DS rather than repeatedly recreating its DNS records.

Plan changes without breaking validation

Before a provider move or disabling signing, follow AWS’s DNSSEC disabling procedure. The parent/child trust chain and cached DS/NS data matter: remove the relevant parent DS and wait for its TTL to expire while signing remains available before stopping signing, following the full AWS procedure for your chain.

Do not assume a BIND import or record snapshot transfers AWS signing keys or recreates the signing setup. Keep signing changes separate from the ordinary-record migration workflow and have your AWS/DNS administrator establish ownership and the current chain before making signing changes.

Check same-named hosted zones before changes

If your AWS account contains multiple hosted zones with the same domain name, do not assume choosing a same-named row selects a particular hosted-zone ID. This module resolves zones by name. Have your AWS administrator compare the exact hosted-zone ID, records and delegated nameservers before using module writes; use AWS’s native zone-specific controls if the target remains ambiguous. Do not create or delete another zone to diagnose that ambiguity.

Check signing and delegation

Your hosting team and AWS/DNS administrator should compare the intended hosted-zone ID, AWS signing/key state, parent DS and validating DNS result. DNSSEC configuration belongs to the supported AWS/registrar workflow; the module does not provide a signing control. Have the administrator responsible for that chain investigate validation or delegation failures.

See the PD AWS Route 53 DNS Blesta guide for related tasks, or explore the module.