DNSSEC Setup with KSK

Question

If I set up DNSSEC (with KSK), will this disrupt my public hosted zone?

**N.B.** My domain isn't registered with Route 53. For more info, the domain is ghi.aub.edu.lb

Accepted Answer

After configuring KSK, you need to update your domain registar with `DS`  records as per [Configuring DNSSEC for a domain](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html).  Setting up DNSSEC should not disrupt your R53 public hosted zone operation if it is configured properly.

For DNSSEC to work, the parent domains must be DNSSEC enabled. However, DNSSEC on `ghi.aub.edu.lb` is not possible as the parent domain `aub.edu.lb` is not DNSSEC enabled.

You can view analysis at [https://dnssec-analyzer.verisignlabs.com/ghi.aub.edu.lb](https://dnssec-analyzer.verisignlabs.com/ghi.aub.edu.lb). Notice that for `aub.edu.lb` 
```
No DS records found for aub.edu.lb in the edu.lb zone
No DNSKEY records found
```

DNSSEC Setup with KSK

Relevant content