Enable DNSSEC for a subdomain setup
In order to use DNSSEC for a subdomain setup, DNSSEC must be enabled on the parent zone.
Ideally, you should also wait 12 to 24 hours after enabling DNSSEC on the parent zone to ensure DNS resolvers provide the same DNS query responses.
Arecord to the child subdomain to validate DNS resolution.
Wait two to six hours. Then, added in the previous step using multiple DNS resolvers with DNSSEC validation (
22.214.171.124). For example, if the
Arecord is for
dig test.child.example.com +dnssec @126.96.36.199.