Do I need to disable the DNSSEC DS record and DNSSEC, let that propagate, and then change nameservers only after that has well propagated?


3 Answers 3


I found that there is a DNSSEC propagation delay, so the approach is:

  1. Disable DNSSEC at Registrar
  2. Wait 24 hours
  3. Disable DNSSEC at Nameserver
  4. Switch nameservers

This was the answer I was looking for, and eventually found through other resources.

  • 1
    Please define "DNSSEC propagation delay". Even if used by everyone there is not really a "propagation" in DNS world as updates do not flow top down. Jun 20, 2019 at 1:24
  • 1
    Disabling the DNSSEC at your DNS provider is dangerous and possible cause for outage. If the records are signed then DS present or no DS, it will still resolve. But with DS and no signed records and you'll risk an outage. Jun 2, 2021 at 18:32

If you use DNSSEC, then when you switch from one DNS provider to another you must take precautions to ensure your DNS resolution continues during the transition.

Your DS record is tied to the specific DNSSEC key that is used to sign your zone. If you move from a DNSSEC provider to a provider that does not support DNSSEC, then you must remove your DS record before switching.

The same rule applies if you switch from one DNS provider with DNSSEC to another DNS provider with DNSSEC. You should remove your DS record first, transition to the new DNS provider, and then have them provide you with the new DS record that you can add to your domain’s registry name servers.


  • Thanks! What are the consequences, if any, of not re-enabling DNSSEC after the transition? - aside from the loss of benefits. Is there going to be any propagation-delayed rejection of the new nameserver due to a lack of DNSSEC (assuming the DS record is already deleted)? I would guess it checks the DS record on-demand, but I don't know the design, so don't know if there are cache and delayed propagation issues like there are with DNS.
    – dyasta
    May 11, 2017 at 2:49
  • If you don't enable DNSSEC it will be just like the squillions of domains that don't have DNSSEC
    – Steve
    May 11, 2017 at 2:54
  • So you understand the necessity for zero-downtime, right? Apparently there are two options: Immediately transfer the DNSSEC into the new zone or disable DNSSEC. Thanks. I just wanted to be sure on the propagation and impact DNSSEC might have on valid resolution. It seems for transfers, it should be disabled, though I am still not clear if disabling DNSSEC takes time to propagate or not.
    – dyasta
    May 12, 2017 at 0:10
  • And I say that because every time I try to disable DNSSEC at Cloudflare, the domain remains unresolvable for X. I haven't tried beyond a couple minutes, as there should be 0 downtime. Maybe a CF issue. And disabling at CF implies I also deleted the DS record at GoDaddy (requirement).
    – dyasta
    May 12, 2017 at 0:56

If you are switching to Google Cloud DNS or another NS that supports DNSSEC transfer state, you can set your incoming NS's DNSSEC to transfer state which allows you to switch without downtime while remaining secure. Essentially the procedure is to use the same signing as the previous NS then add DS on the registrar. If DNSSEC is enabled on the NS but not the registrar, resolution will still happen nominally. That is key to preventing downtime.

To Cloud DNS https://cloud.google.com/dns/dnssec-config#migrating-to

From Cloud DNS https://cloud.google.com/dns/dnssec-config#migrating-from

From the docs:

check that Google Cloud DNS supports the same KSK algorithm already in use. If not, deactivate DNSSEC at your domain registrar before migrating the zone and updating the name server records at the registrar to use the Cloud DNS name servers.

If the existing KSK and ZSK algorithms are supported in Google Cloud DNS, you can perform the migration with DNSSEC enabled, following these steps:

Create a new DNSSEC-signed zone in DNSSEC 'Transfer' state. Transfer state allows you to manually copy DNSKEYs into the zone.

From the transfer pop up:

Entering transfer state DNSSEC will remain enabled for this zone, but only in transfer state. Transfer state allows you to migrate DNS zones between Google Cloud DNS and another DNS provider while keeping DNSSEC enabled.

It is safe to enter transfer state. Google Cloud DNS will still serve your zone and regenerate DNSSEC signatures as needed. However, you should not leave your zone in transfer state indefinitely. The DNSSEC zone signing keys (ZSKs) are not rotated while in transfer state, which reduces the security of your zone over time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.