DNSSEC Guide

Enable DNSSEC inline signing for your zones with one click.

How It Works

hiddenprimary.ch performs inline DNSSEC signing on our nameservers. When you enable DNSSEC, we generate a KSK (Key Signing Key) and ZSK (Zone Signing Key), sign all records, and handle automated key rollovers.

Enable DNSSEC via Portal

  1. Go to Zones and select your zone.
  2. Click the DNSSEC tab.
  3. Click Enable DNSSEC.
  4. Copy the DS record shown and add it at your domain registrar.

Enable DNSSEC via API

terminal
$ curl -X POST https://hiddenprimary.ch/v1/zones/1/dnssec/enable \
  -H "Authorization: Bearer $HP_KEY"
{
  "status": "dnssec enabled"
}

Get DS Records

After enabling DNSSEC, retrieve the DS record to submit to your registrar:

terminal
$ curl https://hiddenprimary.ch/v1/zones/1/dnssec/ds \
  -H "Authorization: Bearer $HP_KEY"

Key Rollover

ZSK rollovers are handled automatically. KSK rollovers can be triggered manually via the portal or API when needed. After you start a KSK rollover, the DNSSEC tab lists a DS record for the old and the new key. Add the new DS at your registrar and keep the old one. Once public resolvers have shown a DS for both keys for 48 hours, we complete the rollover and retire the old key. After that, you can remove the old DS.

terminal
$ curl -X POST https://hiddenprimary.ch/v1/zones/1/dnssec/keys/roll \
  -H "Authorization: Bearer $HP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key_type": "ksk"}'

Disable DNSSEC

Before disabling DNSSEC, remove the DS record from your registrar and wait for TTL expiry. Then disable via portal or API:

terminal
$ curl -X DELETE https://hiddenprimary.ch/v1/zones/1/dnssec \
  -H "Authorization: Bearer $HP_KEY"

Supported Algorithms

We sign with ECDSAP256SHA256 (Algorithm 13), which is widely supported and recommended.

Next Steps