This article describes the implementation of DNSSEC, an extension of the Domain Name System that ensures the authenticity and integrity of DNS responses. It is intended for IT professionals familiar with the subject, as improper use can lead to domain outages. Prerequisites include DNSSEC support by the domain extension and registrar, as well as active Plesk nameservers. Features include signing DNS zones, key generation, and notifications. Activation is done via Plesk, with specific entries required at the domain registrar. Regular updates are necessary to avoid DNS outages.
Introduction
Target Audience
Prerequisites
Features
Access
Activation
Update
Tools
Introduction
DNSSEC is an extension of the Domain Name System (DNS) designed to ensure the authenticity and integrity of DNS response data.
Through technical measures, the requesting computer (e.g., internet browser) can verify whether the response when accessing an internet address in DNS actually comes from the server registered as authoritative. At the same time, it ensures that the response has not been altered during transport over the internet. Simply put: DNSSEC acts like an insurance guaranteeing the internet user that exactly the website they typed in is displayed.
Target Audience
This guide is intended for the responsible IT/web administrators who are already familiar with the topic and confident in enabling DNSSEC. Improper use can lead to domain failure.
Prerequisites
The domain extension (TLD) used as well as the domain registrar must support DNSSEC to allow the necessary DS or DNSKEY records to be set. Additionally, the Plesk nameservers (e.g., ns1/ns2.srv.metanet.ch) must be registered with the domain and active in Plesk.
Features
The following functions are available:
- Sign or remove signing of DNS zones according to DNSSEC specifications
- Specify custom settings for key generation (optional)
- Receive notifications
- View and copy DS resource records
- View and copy DNSKEY resource records
Access
DNSSEC management is accessible in Plesk under "Websites & Domains" → "DNSSEC":
Activation
1. Sign DNS Zone
Clicking on "Sign DNS Zone" opens the options window to finalize configuration before the initial signing.
You can now sign the domain or DNS zone with your desired settings. Please note the rollover period for the Key Signing Key (KSK). DNSSEC keys must be rotated regularly: a Zone Signing Key (ZSK) should be replaced after a maximum of 1 year, and a KSK should undergo rollover at least every 2 years. The difference between a ZSK and KSK rollover is that a KSK rollover requires interaction with the domain registrar. Please also carefully review the "Update" section, as it is essential for ongoing operation.
After signing, the required four DS (or two DNSKEY records) will be displayed.
2. Enable DNSSEC
The four entries mentioned above must now be registered with your domain registrar. For .ch domains, DS records are registered; for example, for .de domains, DNSKEY records are used (these can be retrieved separately via the "Show DNSKEY Records" function). If the registrar only allows 2 DS entries, use only one per key tag (e.g., only SHA-2).
The procedure varies depending on the domain registrar. If the domain is registered with us, you can find the appropriate instructions under DNSSEC Support.
For illustration, below are the required DS entries on my.metanet.ch for the example shown above:
Example .ch domain (with DS):
Alternative example for a .de domain (with DNSKEY) for illustration:
Please note that it may take a moment for the domain registrar to properly recognize the DNSSEC entries if they were recently created in Plesk. If you receive an error when entering the records, wait a few minutes and try again.
| The mandatory regular update (based on the chosen KSK rollover period) is covered in the next section. |
Update
| Make sure that the email address registered in Plesk is reachable. Notifications about required key rollovers are sent only to this email address. |
To prevent DNS outages for the signed domain, more than one KSK and ZSK are deliberately used. A previously generated key remains alongside the new key for some time so that all changes in a DNS zone can be implemented. Obsolete keys are removed automatically.
KSK Rollover
Plesk uses a Double-RRset method variant for the KSK rollover. During the rollover phase, two key signing keys are present simultaneously. This gives you enough time to update the corresponding DS or DNSKEY records at the domain registrar.
Once a rollover occurs, you will be notified by email so you can update the DS or DNSKEY records at the domain registrar. The records become obsolete when the oldest KSK expires and the newest KSK is generated.
Example email:
Subject: <server.metanet.ch> DNSSEC KSK rollover occurred in the DNS zone max-muster.ch Please copy these new DS resource records and add them to the parent zone: max-muster.ch. IN DS 24034 8 1 7CC0A58B06796770E0883D5F679D5BF27908E444 max-muster.ch. IN DS 24034 8 2 4924471919E8C3B492F82B01FD304A88F70799486D715BBDF9611D9BFA45050A max-muster.ch. IN DS 58837 8 1 C866DE39DB0A9A87306E79F5ABB449A69D1E37EE max-muster.ch. IN DS 58837 8 2 45149531BC5654A17DC812EBDA2E6259996CB51BFF2D50963339B6BB64FAEA64
The procedure is the same as the initial activation. Enter the newly received records at your domain registrar.
The records are also viewable at any time via Plesk.
ZSK Rollover (for your information)
No action is required on your part for the ZSK rollover.
To allow sufficient time for synchronization of DNS slave servers and DNS caching servers with the DNS master server, Plesk performs the following:
- A new key is added to the zone a certain time before the rollover.
- The previous key is removed at the same time after the rollover.
The time period before and after the ZSK rollover is called the transition period in Plesk. The transition period is either 30 days or the sum of the SOA TTL and SOA Expire values of the zone (if the sum exceeds 30 days). However, the transition period cannot be longer than half of the ZSK rollover duration, otherwise the rollover function is interrupted and zone signatures become invalid.
To ensure the ZSK rollover is performed correctly, Plesk sets limits for the following values:
- TTL and Expire values of the zone. The sum of these two values must not exceed a certain calculated limit.
- ZSK rollover duration: It cannot be below a certain calculated minimum.
Tools
We recommend the following two websites to verify functionality: