Webmasters Stack Exchange is a question and answer site for pro webmasters. It only takes a minute to sign up.
Sign up to join this community
A client wants to migrate a domain to a new registrar and nameservers. This domain had DNSSEC enabled in the past, the client has disabled DNSSEC by removing the DS record in the domain zone, the DNSSKEY and RRSIG records still exists in the domain zone.
Is it safe to migrate this domain to a new registrar and nameservers without downtime, when the DNSSKEY and RRSIG records still exist?
Edit: The DS record has been removed from the parent zone.
To be 100% sure, you can do online troubleshooting with a tool like DNSViz (or Zonemaster) both a standard test (using current nameservers) and an undelegated test (specifying the new nameserver and hence testing their configuration as if they were the authoritative one for the zone).
You can then assess if everything is in order, including DNSSEC aspect.
Had you specified directly the domain name you are considering, anyone could have tested things out for you...
You state "removing the DS record in the domain zone": the DS record is at parent (the "registry") not in the zone itself. If, indeed, the parent has no DS records for the specific name, then indeed DNSSEC is disabled, and the presence of DNSKEY and RRSIG records in the zone is irrelevant, they will never be taken into account (do not that some security scanner may however report a problem here as considering their presence plus the absence of DS at parent is a sign of a problem).
If everything is ok, you can indeed move the domain to new nameservers and there won't be any issues related to DNSSEC because DNSSEC is not there despite some records in the child zone.
You should however in the long run clean up things: either activate DNSSEC (do not just add a DS record at registry, do check first with same check as above that everything matches) which should be the superior path, or decide once for all to skip DNSSEC and then remove any DNSKEY, RRSIG, NSEC and NSEC3 records from your zone because they are useless.
