Configuring external DNSSEC keys (API only)

Before you begin

• You must have a valid NS1 Connect API key with DNS-related write permissions.
• Enable DNSSEC on the zone, otherwise the external DNSSEC key configuration is ignored.

The dnskey object

Using the API, you can add one or more external DNSSEC keys as a dnskey object, which contains details of one or more public keys in DNSKEY format. Include this object in the request body for PUT and POST methods to create or modify the DNSSEC key sets.

While you can have multiple sets of external DNSSEC keys within a zone, you must create one set at a time. For example, you can create one DNSSEC key set corresponding to each provider that is not NS1 Connect, specifying one or multiple keys that are used by that provider to sign zone data. The way you group external DNSSEC keys into sets is up to you.

The following example demonstrates the dnskey object that must be included in the request body when you create or modify a set of DNSSEC keys.

{
    "dnskey": {
        "ttl": 1200,
        "data": [
            {
                "flags": 256,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "58MeBmjs+4Ry0L+DzBCKR8Y7iQnnj9mCJBvZU7uVRYJ8htKi03lKXs6YySLDSxUMk31TgWPclYc88Z2FUDuI2Q=="
            },
            {
                "flags": 257,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "7LvMDsyZV9qy/vCzPuATbLPA5vqNmbHclp13zIDRQQiQNeBOcsS9WIaJmY+j2ZPEELz8RGq32y85K/YUgUMm2g=="
            }
        ]
    }
}

Within the dnskey object, you can specify a time-to-live (ttl) value (in seconds) for the key set. The data array contains one or more objects where each object in the array corresponds to one DNSSEC key. For each DNSSEC key, you must include the following parameters:

Creating external DNSSEC key sets

Using the API, you can create one or more DNSSEC key sets within a zone. For example, you can create one key set for each DNS provider. In addition to including the dnskey object in the request body, you must also specify the following URL path parameters:

The following example PUT request creates a new DNSSEC key set with two DNSSEC keys (that is, two objects within the data array).

curl -X PUT -H "X-NSONE-Key: $NSONE_API_KEY" https://api.nsone.net/v1/zones/{zone_name}/dnssec/external_keys/{key_set_name} -d '{
    "dnskey": {
        "ttl": 1200,
        "data": [
            {
                "flags": 256,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "58MeBmjs+4Ry0L+DzBCKR8Y7iQnnj9mCJBvZU7uVRYJ8htKi03lKXs6YySLDSxUMk31TgWPclYc88Z2FUDuI2Q=="
            },
            {
                "flags": 257,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "7LvMDsyZV9qy/vCzPuATbLPA5vqNmbHclp13zIDRQQiQNeBOcsS9WIaJmY+j2ZPEELz8RGq32y85K/YUgUMm2g=="
            }
        ]
    }
}'

After you configure the DNSSEC key set on the NS1 Connect platform, you might need to repeat this process within your other DNS provider platforms.

View external DNSSEC key set details

You can view details for all DNSSEC key sets within a zone or set the {key_set_name} query parameter to filter the response to return details for an individual key set.

curl -X GET -H "X-NSONE-Key: $NSONE_API_KEY" https://api.nsone.net/v1/zones/{zone_name}/dnssec/external_keys/{key_set_name}

Modify external DNSSEC key sets

Using the NS1 Connect API, you can edit external DNSSEC key set data by adding, removing, or updating keys within that set. Specify the zone name and the name of the DNSSEC key set in the URL path. You cannot rename an existing DNSSEC key set.

The following example POST request modifies the existing DNSSEC key set data within a zone.

curl -X POST -H "X-NSONE-Key: $NSONE_API_KEY" https://api.nsone.net/v1/zones/{zone_name}/dnssec/external_keys/{key_set_name} -d '{
    "dnskey": {
        "ttl": 1200,
        "data": [
            {
                "flags": 256,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "58MeBmjs+4Ry0L+DzBCKR8Y7iQnnj9mCJBvZU7uVRYJ8htKi03lKXs6YySLDSxUMk31TgWPclYc88Z2FUDuI2Q==string"
            },
            {
                "flags": 257,
                "protocol": 3,
                "algorithm": 13,
                "public_key": "7LvMDsyZV9qy/vCzPuATbLPA5vqNmbHclp13zIDRQQiQNeBOcsS9WIaJmY+j2ZPEELz8RGq32y85K/YUgUMm2g==string"
            }
        ]
    }
}'

Changes to the external DNSSEC keys are reflected immediately.

Delete an external DNSSEC key set

To remove an external DNSSEC key set, specify the zone name and the DNSSEC key set name in the URL path.

curl -X DELETE -H "X-NSONE-Key: $NSONE_API_KEY" https://api.nsone.net/v1/zones/{zone_name}/external_keys/{key_set_name}