← Dns / dns / zone-setups / zone-transfers / cloudflare-as-secondary
DNSSEC options
DNS Security Extensions (DNSSEC) ↗ increase security by adding cryptographic signatures to DNS records. When you use multiple providers and Cloudflare is secondary, you have a few options to enable DNSSEC for records served by Cloudflare.
- Multi-signer DNSSEC: Both Cloudflare and your primary DNS provider know the signing keys of each other and perform their own live-signing of DNS records, in accordance with RFC 8901 ↗.
- Live signing: If your domain is not delegated to your primary provider's nameservers and Cloudflare secondary nameservers are the only nameservers authoritatively responding to DNS queries (hidden primary setup), you can choose this option to allow Cloudflare to perform live-signing of your DNS records.
- Pre-signed: Your primary DNS provider signs records and transfers out the signatures. Cloudflare then serves these records and signatures as is, without doing any signing. By default, Cloudflare uses NSEC records ↗ and not NSEC3 - refer to NSEC3 support if needed. Also, Pre-signed DNSSEC does not support Secondary DNS Overrides nor Load Balancing.
Set up multi-signer DNSSEC
Refer to Set up multi-signer DNSSEC and follow the instructions, considering the note about Cloudflare as Secondary.
Set up live signing DNSSEC
If you use Cloudflare secondary nameservers as the only nameservers authoritatively responding to DNS queries (hidden primary setup), you can enable live signing DNSSEC to have Cloudflare sign the records for your zone.
In this setup, DNSSEC on your primary DNS provider does not need to be enabled.
-
In the Cloudflare dashboard, go to the DNS Settings page.
Go to Settings ↗ -
Under DNSSEC with Secondary DNS select Live signing. You will then have access to several necessary values to create a DS record at your registrar.
-
Add the DS record to your registrar. If Algorithm 13 - Cloudflare's preferred cipher choice - is not listed by your registrar, it may also be called ECDSA Curve P-256 with SHA-256.
Provider-specific DNSSEC instructions
This is not an exhaustive list, but the following links may be helpful:
- Use the Edit DNSSEC Status endpoint and set a
statusofactivefor your zone.
Required API token permissions
At least one of the following token permissions is required:DNS Write
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dnssec" \
--request PATCH \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"status": "active"
}'-
Use the DNSSEC Details endpoint to get the necessary values to create a DS record at your registrar.
-
Add the DS record to your registrar. If Algorithm 13 - Cloudflare's preferred cipher choice - is not listed by your registrar, it may also be called ECDSA Curve P-256 with SHA-256.
Provider-specific DNSSEC instructions
This is not an exhaustive list, but the following links may be helpful:
Set up pre-signed DNSSEC
Prerequisites
- Your secondary zone in Cloudflare already exists and zone transfers from your primary DNS provider are working correctly.
- You have considered whether your primary DNS provider uses NSEC or NSEC3, and have enabled NSEC3 support if needed.
- Your primary DNS provider transfers out DNSSEC related records, such as RRSIG, DNSKEY, and NSEC.
Steps
- Enable DNSSEC at your primary DNS provider.
- Enable DNSSEC for your zone at Cloudflare, using either the Dashboard or the API.
-
In the Cloudflare dashboard, go to the DNS Settings page.
Go to Settings ↗ -
Under DNSSEC with Secondary DNS select Pre-signed.
Use the Edit DNSSEC Status endpoint and set the dnssec_presigned value to true.
Required API token permissions
At least one of the following token permissions is required:DNS Write
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dnssec" \
--request PATCH \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"dnssec_presigned": true
}'-
Make sure Cloudflare nameservers are added at your registrar. You can see your Cloudflare nameservers on the dashboard by going to the DNS Records ↗ page.
-
Make sure there is a DS record added at your registrar. The DS record is obtained from your primary DNS provider (the signer of the zone) and is what indicates to DNS resolvers that your zone has DNSSEC enabled.