Set up multi-signer DNSSEC

This page explains how you can enable multi-signer DNSSEC with Cloudflare, using the model 2 as described in RFC 8901 Open external link .

​​ Before you begin

Note that:

• This process requires that your other DNS provider(s) also support multi-signer DNSSEC.
• Although you can complete a few steps via the dashboard, currently the whole process can only be completed using the API.
• Enabling DNSSEC and Multi-signer DNSSEC in DNS > Settings Open external link only replaces the first step in 1. Set up Cloudflare zone. You still have to follow the rest of this tutorial to complete the setup.

​​ 1. Set up Cloudflare zone

1. Use the Edit DNSSEC Status endpoint Open API docs link to enable DNSSEC and activate multi-signer DNSSEC for your zone. This is done by setting status to active and dnssec_multi_signer to true, as in the following example.

$ curl --request PATCH 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <KEY>' \
--header 'Content-Type: application/json' \
--data '{
  "status": "active",
  "dnssec_multi_signer": true
}'

2. Add the ZSK(s) of your external provider(s) to Cloudflare by creating a DNSKEY record on your zone.

$ curl --request POST 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <KEY>' \
--header 'Content-Type: application/json' \
--data '{
  "type": "DNSKEY",
  "name": "<ZONE_NAME>",
  "data": {
    "flags": 256,
    "protocol": 3,
    "algorithm": 13,
    "public_key": "<PUBLIC_KEY>"
  },
  "ttl": 3600
}'

3. Add your external provider(s) nameservers as NS records on your zone apex.

curl --request POST 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records' \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <KEY>" \
--header "Content-Type: application/json" \
--data '{
  "type": "NS",
  "name": "<ZONE_NAME>",
  "content": "<NS_DOMAIN>",
  "ttl": 86400
}'

4. Enable the usage of the nameservers you added in the previous step by using an API request, as in the following example.

$ curl --request PATCH 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_settings/use_apex_ns' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <KEY>' \
--header 'Content-Type: application/json' \
--data '{
  "id": "use_apex_ns",
  "value": true
}'

​​ 2. Set up external provider

1. Get Cloudflare’s ZSK using either the API or a query from one of the assigned Cloudflare nameservers.

API example:

$ curl 'https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec/zsk' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <KEY>'

Command line query example:

$ dig <ZONE_NAME> dnskey @<CLOUDFLARE_NAMESERVER> +noall +answer | grep 256

2. Add Cloudflare’s ZSK that you fetched in the previous step to the DNSKEY record set of your external provider(s).
3. Add Cloudflare’s nameservers to the NS record set at your external provider(s).

​​ 3. Set up registrar

1. Add DS records to your registrar, one for each provider. You can see your Cloudflare DS record on the dashboard Open external link by going to DNS > Settings > DS Record.

2. Update the nameserver settings at your registrar to include the nameservers of all providers you will be using for your multi-signer DNSSEC setup.