Move DNSSEC to a stronger signing algorithm
Why it matters
The zone is signed with an outdated algorithm (RSA/SHA-1, DSA, GOST or MD5), which is weak and which resolvers are phasing out. Resolvers that reject it will treat your domain as unsigned or fail.
Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.
The fix
- Ask your DNS provider to change the zone's signing algorithm to ECDSA P-256 (algorithm 13) or RSA/SHA-256 (algorithm 8). Providers do this as a managed algorithm rollover, so check their documentation first.
- Do not just swap keys yourself. A careless rollover breaks validation. If you run your own signer (BIND, Knot, PowerDNS), use its algorithm rollover procedure, which follows the order of RFC 6781 section 4.1.4. Step 1, double-sign by publishing the new keys and sign the zone with both algorithms.
- Step 2, after the largest TTL in the zone has passed, add the new DS record at the registrar next to the old one. Step 3, remove the old DS record and wait for its TTL. Step 4, only then remove the old keys and signatures, because removing keys while the old DS is still published breaks validation.
- If your provider has no managed rollover, remove the DS record at the registrar, wait for its TTL (often one to two days), disable signing, enable it again with algorithm 13 and publish the new DS record. The domain is unsigned in between.
- Confirm with DNSViz that the chain is clean, and keep the old DS record available in case you need to roll back.
bash
dig +dnssec DNSKEY example.com dig +dnssec DS example.com
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.