Route 53 - DNSSEC - .IT ccTLD

Question

Hi folks!

We have the majority of our domains registered in Route 53 along with corresponding hosted zones. All are enabled for DNSSEC and work fine.
We have one .it domain that AWS lists as 'Not supported' for DNSSEC, however I do not believe this to be true.

If I check https://dnssec-analyzer.verisignlabs.com/ then the .IT root zone is shown as having the correct DS and DNSKEY records so does appear to be fully supported. Map data from https://www.internetsociety.org/deploy360/dnssec/maps/ also agrees.

Has anyone had any experience with getting .IT domain enabled for DNSSEC on Route 53? I have been able to create the DNSKEY records using Route 53 without issue but cannot complete the deployment due to the 'Not supported' blocker. I can raise a ticket to support but wanted to check here first.

Max Clements · Answer

You should open a ticket with support for this. They are the only ones who will be able to give you a definitive answer.

Renato Gentil · Answer

DNSSEC is not supported in Route 53 for .it domains, this isn't TLD level though, this is at Route 53.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/it.html

Route 53 - DNSSEC - .IT ccTLD

Relevant content