> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# DNSSEC

> Signed by default, the DS record to publish at your registrar, and the one case for an unsigned zone.

## DNSSEC

DNSSEC is **on unless you say otherwise**. The signer bootstraps the zone and
the `dnssec` block appears on it, carrying the key tags, the algorithm (`13`,
ECDSA P-256 SHA-256), and the DS records.

<Warning>
  `dnssec: false` at create time exists for **one** situation: this domain is
  served by another DNS provider at the same time as us. A signed zone puts our
  DS record at the parent, and that DS covers only the answers *we* sign — so a
  validating resolver that happens to ask the other provider gets a signature
  it cannot verify and fails the lookup. Roughly half your queries,
  unpredictably, which is worse than either provider on its own. Unsigned is
  the only configuration that works for that setup today.

  It is fixed at creation, and there is no switch in the console. Turning
  signing off later breaks the domain until the DS is withdrawn at the
  registrar and that withdrawal has propagated — a sequence this API cannot
  drive for you.
</Warning>

To complete the chain of trust, paste the DS record at your **parent
registrar**:

<Steps>
  <Step title="Read the DS records off the zone">
    ```bash theme={null}
    GET /v1/zones/{zone_id}
    ```

    `dnssec.ds_records` holds them. Each also carries `rdata` — the zone-file
    form of the same record, for registrars that want a single string.
  </Step>

  <Step title="Publish it at the registrar">
    This is the one DNSSEC step that cannot be done from here: only the parent
    zone's operator can publish a DS record, and for a public suffix that is
    your registrar.
  </Step>

  <Step title="Validate">
    Once the DS is live, resolvers can validate the chain from the root down
    to your records.
  </Step>
</Steps>

<Warning>
  Until the DS record is published at the registrar, your zone is signed but
  **not validated** — resolvers have no way to reach your keys from the root.
  Signing without a DS buys nothing.
</Warning>