DS record with DNS name ex.com not permitted in zone ex.com. Why?

Question

When I attempt to create a  DS record to establish a chain of trust   
I get an error that I can't understand.  The DS key appears to be correct. I'm not sure why it won't let me create it.  
  
My full error:  
  
**Error occurred**  
Bad request.  
(InvalidChangeBatch 400: RRSet of type DS with DNS name example.com. is not permitted in zone example.com.)  
  
Edited by: 333one on Mar 4, 2021 5:59 PM  
  
Edited by: 333one on Mar 4, 2021 6:00 PM  
  
Edited by: 333one on Mar 4, 2021 6:00 PM  
  
Edited by: 333one on Mar 4, 2021 6:01 PM

mnordhoff · Answer

The DS record for example.com. goes in the com. zone. Your domain registrar will have somewhere to enter it.  
  
If your domain registrar is Amazon, you'll have to use the domain management interface, not the DNS interface.

JCAMPCloud · Answer

Domain Management Interface for the win! In R53, whatever aws account the domain is registered. R53 -> Registered Domains -> Select domain -> DNSSEC keys -> Add key

For me, I registered the domain in my management account and manage my DNS in another account (another hosted zone in another account). I enabled DNSSEC where I manage DNS then added the key in the management account.

DS record with DNS name ex.com not permitted in zone ex.com. Why?

Relevant content