DNSSEC

Sign your zone online: Quathos Monitor generates and manages the keys and signs answers on the nameservers. Your only manual step is publishing the DS record at your registrar to complete the chain of trust.

The status & key objects

Every DNSSEC endpoint returns the same status shape:

Field	Type	Description
`enabled`	boolean	Whether DNSSEC is enabled for the zone.
`keys`	key[]	The signing keys — empty when DNSSEC is disabled.

Key fields

Field	Type	Description
`key_id`	integer	Identifier of the signing key.
`active`	boolean	Whether the key is currently signing the zone.
`dnskey`	string	The public DNSKEY record served by the zone.
`ds_records`	string[]	DS record variants to publish at your registrar.
`algorithm`	string	Signing algorithm (e.g. ECDSAP256SHA256).

Get DNSSEC status

GET /orgs/{org_id}/zones/{zone_id}/dnssec

Returns whether the zone is signed and, if so, its keys with the DS records to publish.

cURL

curl 'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones/42/dnssec' \
  -H 'Authorization: Bearer $QFLARYX_KEY'

Enable DNSSEC

POST /orgs/{org_id}/zones/{zone_id}/dnssec

Generates a signing key and starts signing the zone. Returns 201 with the key — including the ds_records you need next. Enabling twice returns 409.

curl -X POST 'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones/42/dnssec' \
  -H 'Authorization: Bearer $QFLARYX_KEY'

Publish the DS at your registrar

Signing alone doesn't protect resolvers — the chain of trust closes at the parent zone:

Enable DNSSEC and copy a ds_records entry from the response.
At your registrar, add it as a DS record for the domain (some registrars ask for the split fields: key tag, algorithm, digest type, digest).
Wait for the parent zone to publish it, then verify with dig +dnssec example.com — the ad flag from a validating resolver confirms the chain.

Order matters

Never publish a DS before DNSSEC is enabled, and never disable signing while a DS is still published — either mismatch makes validating resolvers treat the domain as bogus and drop it.

Rotate the key

POST /orgs/{org_id}/zones/{zone_id}/dnssec/rotate

Adds a new key while keeping the old one active (dual-key rollover). The response lists both keys. Requires DNSSEC to be enabled (409 otherwise). The safe sequence:

Call rotate — the zone now serves both DNSKEYs.
Publish the new key's DS at the registrar alongside the old one.
After the parent zone and caches have caught up, remove the old DS at the registrar.
Remove the old key (below).

cURL

curl -X POST \
  'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones/42/dnssec/rotate' \
  -H 'Authorization: Bearer $QFLARYX_KEY'

Remove a key

DELETE /orgs/{org_id}/zones/{zone_id}/dnssec/keys/{key_id}

Removes one key after a rollover and returns the remaining keys. The last key cannot be removed this way (422) — disable DNSSEC instead. An unknown key_id returns 404.

cURL

curl -X DELETE \
  'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones/42/dnssec/keys/1' \
  -H 'Authorization: Bearer $QFLARYX_KEY'

Disable DNSSEC

DELETE /orgs/{org_id}/zones/{zone_id}/dnssec

Stops signing the zone and removes its keys. Because disabling with a published DS takes the domain down for validating resolvers, the API requires an explicit confirmation in the body: { "confirm": true }. Without it you get 422:

response · 422 Unprocessable Content

{
  "detail": "Remova o registro DS no registrar ANTES de desabilitar e envie confirm=true — desligar a assinatura com DS publicado derruba o domínio para resolvers validantes"
}

Remove the DS record at your registrar first, wait for it to expire from the parent, then:

cURL

curl -X DELETE 'https://api.qflaryx.com/v1/orgs/$ORG_ID/zones/42/dnssec' \
  -H 'Authorization: Bearer $QFLARYX_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "confirm": true }'

Disabling when DNSSEC is not enabled returns 409.

Previous Records