DNS automation
v1.10.0
Upsert DNSSEC configuration
Enable, disable, or update registry DNSSEC for the specified domain. Use
mode=regfish only when the domain uses regfish authoritative nameservers. Use mode=external only when DNSSEC data must be supplied for external nameservers. Use mode=none together with state=disabled to disable registry DNSSEC. The response may already be final, or it may include a pending_job while the registry or DNS delegation is still converging. If the update cannot be completed, the response returns the last stable DNSSEC state.PUT
/dns/{domain}/dnssec
DomainDNSSECByDomain
Authentication
Parameters
Name
Type
Format
Required
Description
domain
string
-
Required
Fully Qualified Domain Name.
Request body
No description was provided in the specification.
dnssecRequestdnssecRequest
{
"mode": "none",
"state": "disabled"
}Fields
Name
Type
Format
Required
Description
mode
string
-
Required
Requested DNSSEC operating mode. - `none`: no registry DNSSEC should remain active - `regfish`: regfish signs the zone and manages registry trust anchors - `external`: the caller supplies DNSSEC records for external authoritative nameservers
state
string
-
Required
Desired high-level DNSSEC state.
verify_after_apply
boolean
-
Optional
When true, the API immediately refreshes registry state and checks DNS delegation after the update.
records
array<object>
-
Optional
Required for `mode=external,state=enabled`. Ignored for regfish-managed activation and for disable operations.
records[].kind
string
-
Required
-
records[].key_tag
integer
-
Optional
-
records[].flags
integer
-
Optional
-
records[].protocol
integer
-
Optional
-
records[].algorithm
integer
-
Required
-
records[].digest_type
integer
-
Optional
-
records[].digest
string
-
Optional
-
records[].public_key
string
-
Optional
-
records[].comment
string
-
Optional
-
Request example
PUT
curl --request PUT \
--url 'https://api.regfish.com/dns/www.example.com/dnssec' \
--header 'x-api-key: YOUR_API_KEY' \
--header 'content-type: application/json' \
--data '{
"mode": "none",
"state": "disabled"
}'Responses
200
DNSSEC configuration accepted
Response example 200
{
"success": true,
"code": 0,
"response": {
"configured": true,
"dnssec_state": "active",
"mode": "none",
"desired_state": "disabled",
"live_state": "disabled",
"capabilities": {
"supported": true,
"provider": "example",
"mode_regfish_available": true,
"mode_external_available": true,
"accepted_record_kinds": [
"ds"
],
"min_records": 1,
"accepted_algorithms": [
1
]
},
"desired_records": [
{
"kind": "ds",
"algorithm": 1
}
],
"live_records": [
{
"kind": "ds",
"algorithm": 1
}
],
"using_regfish_nameservers": true,
"legacy_mode": true,
"zone_signed": true,
"zone_pending_disable": true
}
}400
Invalid DNSSEC payload
Response example 400
{
"success": false,
"message": "Invalid DNSSEC payload",
"error": "Invalid DNSSEC payload"
}401
Unauthorized
Response example 401
{
"success": false,
"message": "Unauthorized",
"error": "Unauthorized"
}404
Domain not found
Response example 404
{
"success": false,
"message": "Domain not found",
"error": "Domain not found"
}409
DNSSEC cannot be applied in the requested mode or provider state
Response example 409
{
"success": false,
"message": "DNSSEC cannot be applied in the requested mode or provider state",
"error": "DNSSEC cannot be applied in the requested mode or provider state"
}417
DNSSEC record set is invalid for this TLD or provider
Response example 417
{
"success": false,
"message": "DNSSEC record set is invalid for this TLD or provider",
"error": "DNSSEC record set is invalid for this TLD or provider"
}502
Registry-side DNSSEC operation failed
Response example 502
{
"success": false,
"message": "Registry-side DNSSEC operation failed",
"error": "Registry-side DNSSEC operation failed"
}Community
Become part of the community
The regfish DNS API is a great solution for developers who want to automate domains and DNS zones. Become part of the community and benefit from DNS automation. The DNS API is available free of charge to every regfish customer.