DNSSEC

DNSSEC adds digital signatures to DNS answers. A recursive resolver that validates DNSSEC can then confirm that an answer really came from the domain's authoritative servers and wasn't tampered with. This protects against attacks such as cache poisoning.

With Yeap Cloud DNS, once DNSSEC is on, the nameservers sign answers on the fly, so you don't have to manage signing yourself. For DNSSEC to actually take effect, you also have to submit the platform's DS record at your domain registrar. That builds the chain of trust from the parent zone (such as .com).

#Before you start

• The zone must be Active, and the domain's nameservers must already point to the nameservers assigned by the platform (see Zones and records).
• Make sure your registrar lets you add DS records for the domain, with algorithm 13 (ECDSA P-256 / SHA-256) and digest type 2 (SHA-256). Major registrars and common TLDs support both.
• If DNSSEC was turned on for this domain at a previous DNS provider, delete the old DS record at your registrar first. Wait for it to expire from caches before you switch nameservers. Otherwise the domain may stop resolving after the switch.

#Step 1: Turn on DNSSEC for the zone

1. Go to DNS管理 → 区域管理 (DNS Management → Zones) and click the DNSSEC设置 (DNSSEC settings) icon on the zone's row. Or, on the zone's records page, click 更多操作 → DNSSEC 设置 (More → DNSSEC settings).
2. In the DNSSEC 设置 window, click 启用 DNSSEC (Enable DNSSEC) and confirm.
3. The system generates the signing keys (a KSK and a ZSK). The window's DNSSEC 状态 (DNSSEC status) changes to 已启用 (Enabled). It also shows the 签名算法 (signing algorithm), ECDSAP256SHA256, and the Key Tag.

From then on, the nameservers publish DNSKEY records for the zone. Queries that ask for DNSSEC get signed answers (RRSIG records), and names that don't exist get signed negative answers.

#Step 2: Get the DS record

Once DNSSEC is on, the DNSSEC 设置 window lists each field of the DS record. Each field has its own copy button:

Below them, 完整DS记录格式 (Full DS record) shows the whole record, like this:

example.com. 3600 IN DS 12345 13 2 3F8A...(digest)

Some registrars ask for Key Tag, algorithm, digest type and digest as separate fields. Others accept the whole DS line. Use whichever form your registrar asks for.

#Step 3: Add the DS record at your registrar

If the domain is with another registrar: sign in to the registrar, find the domain's DNSSEC or DS record settings, fill in the values from the table above, and save.

If the domain is registered with Yeap Cloud: open 域名注册 → 我的域名 (Domain registration → My domains), open the domain's details, and go to the DNSSEC tab:

• DNS 服务 DNSSEC 状态 (DNS service DNSSEC status) shows the domain's DNSSEC status in Yeap Cloud DNS.
• Under 同步 DNSSEC (Sync DNSSEC), click 同步到注册商 (Sync to registrar) to submit the DS record to the registry.
• Or fill in the fields under 手动添加 DS 记录 (Add DS record manually) and click 提交 DS 记录 (Submit DS record).
• When 注册商 DNSSEC 状态 (Registrar DNSSEC status) shows 已配置 (Configured), the submission worked.

Whether this works depends on whether the registrar connection for that TLD supports DNSSEC. If it doesn't, you'll see a message saying so.

#Step 4: Verify

Once the DS record is live, check that the chain of trust is complete:

# Check that the parent zone publishes the DS record
dig +short DS example.com

# Look at the zone's DNSKEY and signatures (use a nameserver assigned to the zone)
dig +dnssec DNSKEY example.com @<assigned-nameserver>

# Query a validating public resolver; the "ad" flag means validation passed
dig +dnssec www.example.com @1.1.1.1

Online tools such as DNSViz can also draw the whole chain of trust for you.

#Regenerating keys

重新生成密钥 (Regenerate keys) in the DNSSEC 设置 window replaces the KSK and the ZSK at the same time and produces a new DS record. The new keys take effect immediately. The platform does not do a gradual rollover in which old and new keys are published side by side. The old DS at your registrar then no longer matches the new keys, and validating resolvers can't resolve the domain until the new DS is live and the old DS has expired from caches.

#Turning DNSSEC off safely

If you turn off DNSSEC in the console while your registrar still has the DS record, validating resolvers treat the answers as tampered with and the domain stops resolving. Do it in this order:

1. Delete the domain's DS record at your registrar. For domains registered with Yeap Cloud, you can delete it on the DNSSEC tab of the domain's details.
2. Wait for the DS record to expire from caches. Waiting at least 24–48 hours is recommended. Run dig +short DS example.com to confirm the parent zone no longer returns a DS record.
3. Go back to the DNSSEC 设置 window, click 禁用 DNSSEC (Disable DNSSEC) and confirm.

Use the same order when moving a domain off the platform: delete the DS record, wait for caches to expire, then change the nameservers or delete the zone.