Sign in
latestOpenAPI 3.0.2cPanel License2026-08-106251554.3 MB

3da41671c02c

DNS
DNS Security

Enable DNSSEC on domain

This function enables DNSSEC on the domain.

Note:

  • Only servers that run PowerDNS can use DNSSEC. If you call this function on a server that doesn't use PowerDNS, you will receive an error.
  • After you enable DNSSEC on the domain, you must add the Delegation of Signing (DS) records on your DNS server and with your registrar.
  • You cannot modify the DNSSEC security key. To make any changes, you must disable, delete, and re-create the DNSSEC security key.
get/enable_dnssec_for_domains

Query parameters

domainstring domain required
Example:example.com

The domain for which to enable DNSSEC.

Note:

To enable DNSSEC on multiple domains, duplicate or increment the parameter name. For example, to check three domains, you could:

  • Use the domain parameter multiple times.
  • Use the domain, domain-1, and domain-2 parameters.
active0 | 1
Example:1

Whether to activate the newly-created key.

  • 1 - Activate the key.
  • 0 - Do not activate the key.
algo_num5 | 6 | 7 | 8 | 10 | 13 | 14
Example:8

The algorithm that the system uses to generate the security key.

  • 5 - RSA/SHA-1
  • 6 - DSA-NSEC3-SHA1
  • 7 - RSASHA1-NSEC3-SHA1
  • 8 - RSA/SHA-256
  • 10 - RSA/SHA-512
  • 13 - ECDSA Curve P-256 with SHA-256
  • 14 - ECDSA Curve P-384 with SHA-384

Note:

We recommend that you use an ECDSA Curve P-256 with SHA-256 (13) value if your registrar supports it.

key_setup'classic' | 'simple'
Example:classic

The manner in which the system creates the security key.

  • classic - Use separate keys for KSK and ZSK. Use this value when the algo_num parameter is equal to or less than 8.
  • simple - Use a single key for both KSK and ZSK. Use this value when the algo_num parameter is greater than 8.
nsec3_iterationsinteger
Example:7

The number of times that the system rehashes the first resource record hash operation.

nsec3_narrow0 | 1
Example:1

Whether NSEC3 operates in Narrow or Inclusive mode.

Note:

For information about these modes, read PowerDNS's DNSSEC documentation.

  • 1 - Narrow mode.
  • 0 - Inclusive mode.
nsec3_opt_out0 | 1
Example:1

Whether the system will create records for all delegations.

  • 1 - Create records for all delegations.
  • 0 - Create records only for secure delegations.

Note:

Only use the 1 value if you must create records for all delegations.

nsec3_saltstring
Example:1a2b3c4d5e6f

A hexadecimal string that the system appends to the domain name before it applies the hash function to the name.

Note:

For information about salt values, read RFC 5155.

use_nsec30 | 1
Example:1

Whether the domain will use Next Secure Record (NSEC) or NSEC3 semantics.

  • 1 - Use NSEC3 semantics.
  • 0 - Use NSEC semantics.

Note:

If you use this value, the system ignores the other NSEC3 options.

Response

HTTP Request was successful.

Example response

{
  "data": {
    "domains": [
      {
        "domain": "example.com",
        "enabled": 1,
        "new_key_id": "2",
        "nsec_error": "Error message.",
        "nsec_version": "NSEC3"
      }
    ]
  },
  "metadata": {
    "command": "enable_dnssec_for_domains",
    "reason": "OK",
    "result": 1,
    "version": 1
  }
}