DNSSEC

Sign your zone online: Quathos Monitor generates and manages the keys and signs answers on the nameservers. Your only manual step is publishing the DS record at your registrar to complete the chain of trust.

The status & key objects

Every DNSSEC endpoint returns the same status shape:

Key fields

Get DNSSEC status

Returns whether the zone is signed and, if so, its keys with the DS records to publish.

curl "https://api.monitor.quathos.com/v1/orgs/$ORG_ID/zones/42/dnssec" \
  -H "Authorization: Bearer $SESSION_TOKEN"

Enable DNSSEC

Generates a signing key and starts signing the zone. Returns 201 with the key, including the ds_records you need next. The zone must be active (409 dnssec_zone_inactive otherwise); enabling twice returns 409 dnssec_already_enabled.

curl -X POST "https://api.monitor.quathos.com/v1/orgs/$ORG_ID/zones/42/dnssec" \
  -H "Authorization: Bearer $SESSION_TOKEN"

{
  "enabled": true,
  "keys": [
    {
      "key_id": 1,
      "active": true,
      "dnskey": "257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==",
      "ds_records": [
        "42 13 2 a3cf809dbdbc835716ba22bdc370d2c5c01ff9c4b724d5f9560c8f2d9b733dc4"
      ],
      "algorithm": "ECDSAP256SHA256"
    }
  ]
}

Publish the DS at your registrar

Signing alone doesn't protect resolvers: the chain of trust closes at the parent zone.

1. Enable DNSSEC and copy a ds_records entry from the response.
2. At your registrar, add it as a DS record for the domain (some registrars ask for the split fields: key tag, algorithm, digest type, digest).
3. Wait for the parent zone to publish it, then verify with dig +dnssec example.com: the ad flag from a validating resolver confirms the chain.

Rotate the key

Adds a new key while keeping the old one active (dual-key rollover). The response lists both keys. Requires DNSSEC to be enabled (409 dnssec_enable_first otherwise). The safe sequence:

1. Call rotate: the zone now serves both DNSKEYs.
2. Publish the new key's DS at the registrar alongside the old one.
3. After the parent zone and caches have caught up, remove the old DS at the registrar.
4. Remove the old key (below).

curl -X POST "https://api.monitor.quathos.com/v1/orgs/$ORG_ID/zones/42/dnssec/rotate" \
  -H "Authorization: Bearer $SESSION_TOKEN"

Remove a key

Removes one key after a rollover and returns the remaining keys. The last key cannot be removed this way (422 dnssec_last_key): disable DNSSEC instead. An unknown key_id returns 404 dnssec_key_not_found.

curl -X DELETE "https://api.monitor.quathos.com/v1/orgs/$ORG_ID/zones/42/dnssec/keys/1" \
  -H "Authorization: Bearer $SESSION_TOKEN"

Disable DNSSEC

Stops signing the zone and removes its keys. Because disabling with a published DS takes the domain down for validating resolvers, the API requires an explicit confirmation in the body: { "confirm": true }. Without it you get 422:

HTTP/2 422
x-error-code: dnssec_remove_ds_first

{"detail":"Remove the DS record at the registrar BEFORE disabling and send confirm=true — turning off signing with a published DS takes the domain down for validating resolvers"}

Remove the DS record at your registrar first, wait for it to expire from the parent, then:

curl -X DELETE "https://api.monitor.quathos.com/v1/orgs/$ORG_ID/zones/42/dnssec" \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "confirm": true }'

Disabling when DNSSEC is not enabled returns 409 dnssec_not_enabled.