ANAYIL GROUPHosting · My Domains Submit a Ticket
Help center
HomeDNSCoordinate DNSSEC and DS records without disrupting a domain
DNS6 min•Difficulty: Básico

Coordinate DNSSEC and DS records without disrupting a domain

Avoid breaking the DNSSEC chain of trust when changing providers, keys or delegation.

Equipo de documentación AnayilUpdated: 2026-10-10

Apply this guide to your situation

This answer covers “Coordinate DNSSEC and DS records without disrupting a domain”. Read it with the summary and confirm that the symptom and service match what you are experiencing. Available options can vary by plan and account setup.

  • Before changing anything, note what you expected, what happened and roughly when. Check whether the issue affects one page or the whole service.
  • Save the full error message and note recent changes. Hide passwords, access codes, personal data and keys before sharing screenshots or logs.
  • If a step requires administrator access, restarting services or editing server files, stop if you do not administer that server. Send support the service name, error and checks you have already made.

Likely-cause and resolution matrix

Follow a branch only when evidence supports it. A symptom may have more than one cause; do not change layers by guesswork.

01Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):
bash
Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

02Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):
bash
Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

03Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):
bash
Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

04Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):
bash
Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

05Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):
bash
Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

Prerequisites

  • Registrar access and coordination with the operator of the signed DNS zone.
  • Keep the service identifier available and do not share credentials.

Important warnings

  • Portal labels and options vary by product and provider. This guide explains the general process and does not confirm that the action is available in Anayil Panel.
  • Before confirming purchases, DNS changes, cancellations or deletions, review consequences, charges and recovery options.

Step-by-step walkthrough

1. Understand the situation

With DNSSEC, the registrar publishes a DS record that must match a DNSKEY in the signed zone. A stale DS, an unpublished replacement key or disabling signing in the wrong order can cause validating resolvers to return SERVFAIL even when other resolvers appear to work.

2. Follow the process carefully

Before changing anything, confirm whether the zone is signed and securely record the current DS values. Ask the DNS operator for its supported rollover procedure. Coordinate publication of new DNSKEY/signatures and DS records in that order; do not delete DS or change nameservers as a test. When moving to DNS without DNSSEC, follow the documented removal sequence before leaving the old zone.

3. Check the result

Check DS at the registrar and DNSKEY/signatures on authoritative servers. Validate through more than one resolver with `dig +dnssec example.com DS` and `dig +dnssec example.com A`; confirm SERVFAIL is absent before closing the change.

Troubleshooting & Solutions

The expected option or status does not appear

Root cause: The service, plan, role or registrar may differ from what the guide assumes.

Resolution: Do not repeat the action. Confirm the provider, service and permissions, then contact support with the case reference.

Rollback and recovery plan

If you have not confirmed the change, go back and keep the current information. If you already confirmed it, do not make successive changes to compensate: save the confirmation and ask the provider for the recovery process for this service.

Related runbooks in this category:

Was this technical guide helpful?

Facing a production outage?

Hosting Anayil system administrators can directly intervene on your server infrastructure.

Open Support Ticket at Hosting Anayil