Managing DNSSEC for domains pointed to Custom DNS Print

When you point your domain to Custom DNS (such as Cloudflare, Amazon Route 53, or your own private nameservers), Nixzoehost no longer manages your DNS records. However, because we are still your Registrar, we are the only ones who can "tell" the registry that your custom DNS records are secure.

This requires a manual "handshake" between your DNS provider and Nixzoehost.

Managing DNSSEC for Custom DNS

If you use custom nameservers, your DNS provider (e.g., Cloudflare) will generate the digital signatures. To complete the Chain of Trust, you must manually copy the security keys from their dashboard and paste them into your Nixzoehost account.

Step 1: Generate the DS Records

Log in to your external DNS provider (where your nameservers are hosted).

1. Look for a section labeled DNSSEC.

2. Click Enable DNSSEC.

3. The provider will generate a set of values known as a DS (Delegation Signer) Record. You will typically see:

   • Key Tag (a 5-digit number)

   • Algorithm (e.g., 13 - ECDSA Curve P-256 with SHA-256)

   • Digest Type (e.g., 2 - SHA-256)

   • Digest (a long string of letters and numbers)

Step 2: Add the Records to Nixzoehost

1. Log in to your Nixzoehost Client Area.

2. Go to Domains > My Domains > Manage.

3. On the left sidebar, click Advanced DNS.

4. Find the DNSSEC section and click Add New DS Record.

5. Carefully paste the values provided by your DNS host into the corresponding fields.

6. Click Save Changes.

The Golden Rule: "Turn Off Before You Move"

The most common cause of "website downtime" for advanced users is a DNSSEC mismatch.

• If you change Nameservers: You MUST delete the DS records in your Nixzoehost dashboard before you change your nameservers.

• Why? If you point your domain to a new host but the old DNSSEC "lock" is still active at the registry, the new host's records will be seen as "unsigned" or "fraudulent." Resolvers (like Google DNS) will block your site entirely.

Common Troubleshooting

• Status: Bogus: If a DNS checker tool says your domain is "Bogus," it means your DS records at Nixzoehost do not match the keys at your DNS provider. Double-check the Key Tag and Digest.

• Propagation: After adding a manual DS record, it can take up to 24 hours for the registry to update the global chain.

• Multiple Records: Some providers give you two DS records (one for SHA-1 and one for SHA-256). You should add both to Nixzoehost to ensure maximum compatibility.