This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 34%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAE%3C/text%3E%3C/svg%3E)
I have a DNS Zone that was purchased through Microsoft and I am attempting to setup DNSSEC. I have copy/pasted the DS record into a new DS recordset on the DNS Zone, but it will not resolve.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 38%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Make sure you add the DS record to the parent zone.
Details at https://learn.microsoft.com/en-us/azure/dns/dnssec-how-to?tabs=sign-portal
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin
It is the top-level zone; i.e. abcdef.com
Verify that this step completes successfully (from the child zone - i.e. the ones where you copy the DS records from)
When the DS record has been uploaded to the parent zone, select the DNSSEC information page for your zone and verify that Signed and delegation established is displayed. Your DNS zone is now fully DNSSEC signed.
In short, follow https://learn.microsoft.com/en-us/azure/dns/dnssec-how-to?tabs=sign-portal
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin
I'm not sure if it's obvious or not, but abcdef.com is the apex domain. Does this mean I add the DS record to the same Azure DNS Zone?
I am not sure if it helps or not, but the domain is askmoka.com
Then as per https://learn.microsoft.com/en-us/azure/dns/dnssec-how-to?tabs=sign-portal
If the parent zone is a top level domain (for example: .com), you must add the DS record at your registrar. Each registrar has its own process. The registrar might ask for values such as the Key Tag, Algorithm, Digest Type, and Key Digest. In the example shown here, these values are:
Key Tag: 4535 Algorithm: 13 Digest Type: 2 Digest: 7A1C9811A965C46319D94D1D4BC6321762B632133F196F876C65802EC5089001
When you provide the DS record to your registrar, the registrar adds the DS record to the parent zone, such as the Top Level Domain (TLD) zone.
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin
Thanks for the reply; but the domain was purchased using "New Custom Domain" through the "Add Domain" button on the SQA. I would have thought Azure is the registrar. If not, who is?
If your domain is managed in Azure:
.com).If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin
That was the piece I was missing -- I needed to navigate to the App Service Domain and not the DNS Zone. Thanks for your assistance!