DNS
DNS Security
Create domain's DNSSEC zone key
This function generates a DNSSEC zone key for a domain.
Note:
- Only servers that run PowerDNS can use DNSSEC. If you call this function on a server that doesn't use PowerDNS, you will receive an error.
- After you enable DNSSEC on the domain, you must add the Delegation of Signing (DS) records to your zone record and your registrar.
- You cannot modify the DNSSEC security key. To make any changes, you must disable, delete, and re-create the DNSSEC security key.
get/add_zone_key
Query parameters
algo_num5 | 6 | 7 | 8 | 13 | 14 required
Example:13
The algorithm that the system uses to generate the security key.
- 5 — RSA/SHA-1
- 6 — DSA-NSEC3-SHA1
- 7 — RSA SHA1-NSEC3-SHA1
- 8 — RSA/SHA-256
- 13 — ECDSA Curve P-256 with SHA-256
- 14 — ECDSA Curve P-384 with SHA-384
Note:
We recommend that you use a 13 (ECDSA Curve P-256 with SHA-256) value if your registrar supports it.
domainstring required
Example:example.com
The domain for which to enable DNSSEC.
key_typestring required
Example:ksk
The type of security key to add.
- ksk — Key Signing Key.
- zsk — Zone Signing Key.
Note:
You must call these values in lowercase.
active0 | 1
Example:1
Whether to activate the new security key.
- 1 — Activate.
- 0 — Do not activate.
key_size256 | 384 | 1024 | 2048
Example:256
The security key size, in bits.
Note:
This parameter defaults to the following values, depending on the algo_num and key_type values:
- algo_num = 5
- ksk = 2048
- zsk = 1024
- algo_num = 6
- ksk = 2048
- zsk = 1024
- algo_num = 7
- ksk = 2048
- zsk = 1024
- algo_num = 8
- ksk = 2048
- zsk = 1024
- algo_num = 13
- ksk and zsk = 256
- algo_num = 14
- ksk and zsk = 384
Response
HTTP Request was successful.
Example response
{
"data": {
"new_key_id": "1"
},
"metadata": {
"command": "add_zone_key",
"reason": "OK",
"result": 1,
"version": 1
}
}