Set up DNSSEC

DNSSEC signs a zone's answers so that resolvers can check they came from the zone's nameservers unchanged. Coritan signs every zone it hosts from the moment you add it. Resolvers check the signatures once the domain's registry publishes the zone's DS records, which you add at the domain's registrar.

A free Coritan name, such as survival-smp.coritan.gg, needs no step from you: Coritan publishes its DS records in coritan.gg when you claim it.

Coritan signs with algorithm 13, ECDSAP256SHA256, and two keys:

Key-signing key (KSK)

Signs the zone's keys. The DS records are made from it, so they stay the same for as long as the zone keeps this key.

Zone-signing key (ZSK)

Signs the zone's records. Coritan replaces it on a schedule, which needs no change at the registrar.

The domain's Settings tab shows the zone's Algorithm, KSK key tag, ZSK key tag and Last ZSK rotation on the DNSSEC card.

• The domain's DNS must be hosted on Coritan, and the domain must use Coritan's nameservers at its registrar (Add a domain you already own).
• You need to be able to change the domain's DNSSEC settings at its registrar.

1. In the dashboard, go to Websites, open the domain and select the Settings tab.

2. Check that the DNSSEC card shows the zone as enabled.

3. On the DS records for the registrar card, copy the records. Each one reads like this, with the key tag, the algorithm, the digest type and the digest after DS:

   DNS

   example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…
   example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…
   

4. At your registrar, open the domain's DNSSEC settings and add a DS record with the values from the first record: key tag 2371, algorithm 13, digest type 2 (SHA-256) and the digest. If the registrar accepts digest type 4 (SHA-384), you can add the second record as well.

5. Save the change at the registrar.

For a domain registered with Coritan, the dashboard has no way to send DS records to the registry, so resolvers treat the zone as unsigned and do not check its signatures. Contact support if you need DNSSEC validated for such a domain.

Once the registry publishes the DS record, validating resolvers check every answer from the zone. The registry publishes changes on its own schedule. Check from a terminal that the DS record is live and that a validating resolver accepts the zone's answers:

dig example.com DS +short
dig @1.1.1.1 example.com A +dnssec

The second command's flags include ad when the resolver has checked the signatures.

SERVFAIL from validating resolvers

The DS record at the registrar does not match the zone's key. Compare it with the DS records for the registrar card, and delete any DS record left by a previous DNS provider.

Signing is off for this zone.

The zone is not signed, so it has no DS records to publish. Contact support to turn signing on.

The DS records on the card have changed

The zone has a new key-signing key. Replace the DS records at your registrar with the new ones straight away, because validating resolvers refuse the zone's answers until the two match.

• How DNS hosting works
• Change a domain's nameservers
• Delete a DNS zone

Read a zone's DNSSEC status and DS records:

curl https://api.coritan.com/api/v1/dns/zones/42/dnssec \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "enabled": true,
  "algorithm": "ECDSAP256SHA256",
  "ksk_key_tag": 2371,
  "zsk_key_tag": 40125,
  "ds_records": [
    "example.com. IN DS 2371 13 2 1F987CC6583E92DF0890718C42…",
    "example.com. IN DS 2371 13 4 6D0C1BD5A4E1F2B7C3D8E9F0A1…"
  ],
  "zsk_rotated_at": "2026-09-20T03:00:00Z"
}

ds_records is empty when enabled is false. zsk_rotated_at is null until Coritan first replaces the zone-signing key.