How to Manage DNSSEC Keys

The purpose of this article is to explain how to manage the DNSSEC keys of your domain.

The DNSSEC protocol is an additional security measure standardised by the IETF to authenticate communications via the DNS protocol.

DNSSEC cannot be activated for a subdomain.

The glossary contains explanations on a wide range of subjects and can be consulted to clarify certain terms.

Prerequisite

Enter the following address in your web browser: https://mg.n0c.com/en/.

How to Activate DNSSEC

When you activate DNSSEC, you have to choose between algorithm 13 (ECDSAP256SHA256) and algorithm 8 (RSASHA256). Algorithm 13 is, from a cryptographic point of view, strong, and its use is currently recommended for new DNSSEC deployments due to its shorter keys and signature size, which result in smaller DNS packets. However, Algorithm 8 may also be used, as it is widely deployed and has been the default algorithm for a number of years due to its cryptographic strength.

To activate DNSSEC:

1. In the sidebar menu, select Domains -> Domain Management and click on the DNSSEC button beside the domain name:

2. Click on the Activate button:

3. Using the radio buttons, choose an algorithm. It can be Algorithm 8 (RSASHA256) or, as recommended, Algorithm 13 (ECDSAP256SHA256) and click on the Enable button:

4. The information is then displayed:

5. The Details icon allows to display or to hide the information:

Special Case: Domain Registered with Another Registrar

If your web host and your domain provider (domain name registrar) are not on the same platform, you will see this message when activating DNSSEC:

To manually activate DNSSEC at the level of your domain name registrar (where you purchased the domain):

1. In your MG control panel, enable DNSSEC to generate the parameters.
2. Make a note of the information provided: the Keytag, the algorithm, the digestType and the digest value.
3. Log in to your domain name registrar client area.
4. Go to its domain management section and locate the DNSSEC section to add and save the values you have noted down.

How to Disable DNSSEC

1. In the sidebar menu, select Domains -> Domain Management and click on the DNSSEC button beside the domain name:

2. Click on the Disable button:

3. Confirm by clicking on the Disable button in the Disable DNSSEC? popup window.