Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Critical updates to articles in the DNS section - final articles #1253

Open
wants to merge 22 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions content/articles/auto-import-dns.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ categories:
# Auto-Importing DNS Records

<info>
Legacy Plans don't have access to this feature. To switch to one of our current plans and unlock this tool, click [here](/articles/changing-plans/).
Legacy Plans don't have access to this feature. You'll need to be subscribed to one of our [current plans](https://dnsimple.com/pricing) to use this tool.
</info>

Auto-importing DNS records helps reduce downtime on your domain transfer or when hosting the DNS for your domain with us.
Expand All @@ -25,14 +25,14 @@ We can import these DNS record types:
- [AAAA](/articles/aaaa-record)
- [CNAME](/articles/cname-record)
- [MX](/articles/mx-record)
- TXT
- [TXT](/articles/txt-record/)

We prompt you to auto-import DNS records when:

- A domain transfer is about to start.
- Adding a domain for DNS management.
- A [domain transfer](/articles/domain-transfer/) is about to start.
- [Adding a domain](/articles/adding-domain/) for DNS management.

Auto-import the zone for your domain any time by clicking on <label>Auto-import DNS</label> from the record editor.
You can auto-import the zone for your domain any time by clicking on **Auto-import DNS** from the record editor.

## Overview

Expand All @@ -42,13 +42,16 @@ We automatically look for the most common subdomains, like `www`, `blog`, and `e

![Overview](/files/auto-import-dns-overview.png)

Once you have all the necessary records, click <label>Import DNS records</label> to add them to your domain zone.
Once you have all the necessary records, click **Import DNS records** to add them to your domain zone.

## Managing conflicts

If auto-importing a record conflicts with an existing record on your domain, we ask you to confirm which record you'd like to keep. By default, we don't override the records on your domain. You'll have to select the record that applies in your context.

![Overview](/files/auto-import-dns-conflict.png)

Once you've made a selection, click on <label>Import DNS records</label> to add them to your domain zone.
Once you've made a selection, click **Import DNS records** to add them to your domain zone.

## Have more questions?

If you have any questions or need assistance
52 changes: 27 additions & 25 deletions content/articles/dnssec.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,22 +19,22 @@ categories:

---

DNSSEC provides a way to cryptographically build a chain of trust from the root name servers to authoritative name servers. Authenticating resolvers may verify this chain of trust to ensure the DNS results weren't tampered with while in transit.
DNSSEC provides a way to cryptographically build a chain of trust from the [root name servers](https://en.wikipedia.org/wiki/Root_name_server) to [authoritative name servers](https://en.wikipedia.org/wiki/Name_server#Authoritative_name_server). Authenticating resolvers may verify this chain of trust to ensure the DNS results weren't tampered with while in transit.

## DNSSEC scenarios

There are a variety of scenarios that DNSimple facilitates to ensure that your zone is signed. Use the scenarios below to understand how to configure your domain/zone.

### Scenario: Registered *&* DNS-hosted at DNSimple
### Scenario 1: Registered *&* DNS-hosted at DNSimple

1. [Enable DNSSEC](#enabling-dnssec) for *automatic* zone signing, provisioning, and [key rotation](#key-rotation).

### Scenario: Registered at DNSimple, but DNS-hosted elsewhere
### Scenario 2: Registered at DNSimple, but DNS-hosted elsewhere

1. Set up DNSSEC through your DNS provider.
1. When you have the DNSSEC details, add them to your domain's registrar using our [DS management page](/articles/manage-ds-record/).

### Scenario: Registered elsewhere, but DNS-hosted at DNSimple
### Scenario 3: Registered elsewhere, but DNS-hosted at DNSimple

1. [Enable DNSSEC](#enabling-dnssec) to sign your zone. This initiates automatic [key rotation](#key-rotation).
1. After enabling, copy the DS record details over to your domain's registrar.
Expand All @@ -44,48 +44,50 @@ There are a variety of scenarios that DNSimple facilitates to ensure that your z

DNSSEC is applied on a per-domain basis. You can manage DNSSEC by using the DNSSEC tab on a domain's management page.

![Access DNSSEC through the DNSSEC tab on your domain management page](/files/dnssec-tab.png)
<!--- needs screenshot -->
dperrymorrow marked this conversation as resolved.
Show resolved Hide resolved

## Enabling DNSSEC

To enable DNSSEC, click on the "Configure" link on the DNSSEC management page.
To enable DNSSEC, click **Configure** on the DNSSEC management page.

![Configure DNSSEC](/files/dnssec-configure.png)

Click on the "Enable DNSSEC" button.
Click **Enable DNSSEC**.

![Enable DNSSEC](/files/dnssec-enable.png)

If your domain is registered with DNSimple and using our name servers, the zone is signed, and the DS record will be provisioned in the appropriate domain registry.

If your domain is hosted with us but registered elsewhere, you need to provide the DS record we give you once your zone is signed to your domain registrar. You also need to update your DS record with your domain registrar once every 90 days, as we automatically rotate both zone signing keys and key signing keys.
If your domain is hosted with us but registered elsewhere, you need to provide the DS record we give you once your zone is signed to your domain registrar. You also need to update your DS record with your domain registrar once every 90 days, as we automatically rotate both zone signing keys and key-signing keys.

![DNSSEC DS record](/files/dnssec-configuration-dsrecord.png)

A warning message may be shown to highlight potential issues with DNSSEC enablement, such as:
A warning message may be shown to highlight potential issues with DNSSEC enablement, for example:
- The authoritative name servers for the zone are not all returning the same DNSKEY records.
- The authoritiatve name servers for the zone are not returning DNSKEY records that match up with the DS record or zone signing data.
- The DS record has not yet been provisioned at the registrar.

The warning does not necessarily mean that any action is needed on your part, because the issues may resolve on their own after changes from enabling DNSSEC have been propagated.
<info>
The warning does not necessarily mean that any action is needed on your part. The issues may resolve on their own after changes from enabling DNSSEC have been propagated.
</info>

![DNSSEC Enablement warning](/files/dnssec-enable-warning.png)

## Disabling DNSSEC

<warning>
If your domain is registered with another domain registrar, you should ideally remove the DS record from that registrar *before* removing the zone signing from DNSimple. Failure to remove the DS record within 48 hours of disabling DNSSEC will result in DNSSEC validation failures and will stop your domain from resolving with all DNSSEC-aware resolvers.
If your domain is registered with another domain registrar, we strongly recommend removing the DS record from that registrar *before* removing the zone signing from DNSimple. Failure to remove the DS record within 48 hours of disabling DNSSEC will result in DNSSEC validation failures and will stop your domain from resolving with all DNSSEC-aware resolvers.
</warning>

To disable DNSSEC, go to the DNSSEC tab for the domain, and find the "Disable DNSSEC" card.
To disable DNSSEC, click the **DNSSEC** tab for the domain, and locate the **Disable DNSSEC** card.

![DNSSEC configured](/files/dnssec-configured.png)
<!--- needs screenshot -->
dperrymorrow marked this conversation as resolved.
Show resolved Hide resolved

Click on the "Disable DNSSEC" button to remove the zone signing and the DS record if it is present.
Click **Disable DNSSEC** to remove the zone signing and the DS record if it is present.

![DNSSEC disable](/files/dnssec-disable.png)

Note: When you click on the "Disable DNSSEC" button for a domain that is registered with another domain registrar, you will also see a reminder message to remove the DS record within 48 hours to prevent DNSSEC validation failures.
<info>
When you click **Disable DNSSEC** for a domain that is registered with another domain registrar, you will see a reminder message to remove the DS record within 48 hours to prevent DNSSEC validation failures.
</info>

![DNSSEC disable for hosted domains](/files/dnssec-disable-hosted.png)

Expand All @@ -98,7 +100,7 @@ Whether the TLD of the domain requires the DS records to be set up with the DS-D
DNSimple rotates key signing keys and zone signing keys every 90 days. Auto-rotation is mandatory. You can't disable it.

- If your domain is registered with us and uses our authoritative name servers: we handle rotation of keys automatically.
- If your domain is NOT registered with us or DOES NOT uses our authoritative name servers: you'll receive an email notification with the new DS record whenever key rotation starts, **and you'll need to rotate the DS records (remove the old record and add the new record) at your domain registrar within 7 days**.
- If your domain is NOT registered with us or DOES NOT uses our authoritative name servers: you'll receive an email notification with the new DS record whenever key rotation starts. **You'll need to rotate the DS records (remove the old record and add the new record) at your domain registrar within 7 days**.

<warning>
#### Failure to update the DS record at your registrar will result in downtime
Expand Down Expand Up @@ -130,17 +132,17 @@ CDS and CDNSKEY record types are automatically generated for all DNSimple zones

You can find details about how CDS/CDNSKEY work in [RFC 8078](https://tools.ietf.org/html/rfc8078).

### DS records without a corresponding DNSKEY

When a DS record is present at your domain registrar, but there's no corresponding DNSKEY in your zone, DNSSEC-aware resolvers will fail to resolve your domain. For example, with Google Public DNS this will result in a SERVFAIL. Clients using a non-DNSSEC-aware resolver will still be able to resolve your domain.

To fix this issue, [remove the DS record](/articles/manage-ds-record/#removing-a-ds-record) from your registrar. This won't immediately fix resolution for some clients, as they'll see the cached DS record. DS record time-to-live values are set by domain registries and may be set to values of 12 hours or more.

## Troubleshooting DNSSEC configurations

These tools are helpful for troubleshooting DNSSEC configuration issues:

- [Verisign DNSSEC Debugger](http://dnssec-debugger.verisignlabs.com/)
- [DNSViz](http://dnsviz.net/)

You can also [contact DNSimple support](https://dnsimple.com/contact) with additional questions.

### DS records without a corresponding DNSKEY

When a DS record is present at your domain registrar, but there's no corresponding DNSKEY in your zone, DNSSEC-aware resolvers will fail to resolve your domain. For example, with Google Public DNS this will result in a SERVFAIL. Clients using a non-DNSSEC-aware resolver will still be able to resolve your domain.

To fix this issue, [remove the DS record](/articles/manage-ds-record/#removing-a-ds-record) from your registrar. This won't immediately fix resolution for some clients, as they'll see the cached DS record. DS record time-to-live values are set by domain registries and may be set to values of 12 hours or more.
You can also [contact DNSimple support](https://dnsimple.com/contact) with any questions, and we'll be happy to help.
19 changes: 16 additions & 3 deletions content/articles/record-notes.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ categories:

---

When creating, updating, or deleting a DNS record from the [DNS record editor](/articles/record-editor), you can include a note to explain the purpose of the record change.
When creating, updating, or deleting a DNS record from the [DNS record editor](/articles/record-editor), you can include a note to provide context for the change. They can be used to explain why a record exists, what it's used for, or any other information that might be useful to you or your team.

## Video walk-through

Expand All @@ -24,13 +24,22 @@ When creating, updating, or deleting a DNS record from the [DNS record editor](/

## Creating a record note

When you create or update a DNS record, you can fill in the _Notes_ field with the purpose of the record.
1. Click the relevant domain in your Domain List.
1. Click the DNS badge in the top right.

<!--- needs screenshot -->
dperrymorrow marked this conversation as resolved.
Show resolved Hide resolved

1. To add a note to an existing record, click the **Add Note** icon on the right side, and type your note.

<!--- needs screenshot -->

dperrymorrow marked this conversation as resolved.
Show resolved Hide resolved
1. To add a note when creating a record, click **Add Record**, create your record, and enter your note in the **Notes** field.

![Record notes](/files/record-notes.png)

## Viewing a record note

When you update a record, you'll be able to view the note associated with the record in the _Notes_ field, if one exists.
When you update a record, you'll be able to view the note associated with the record in the **Notes** field, if one exists.

![Viewing record notes](/files/record-notes-edit.png)

Expand All @@ -57,3 +66,7 @@ When deleting a record, you can also include a note to help you remember why you
When you create, update, or delete a record, and add a record note, the note will be included with the DNS record activity in your [audit history](/articles/activity-tracking).

![Record note in audit history](/files/record-notes-activities.png)

## Have more questions?

If you have any questions about record notes or how they work, [contact our support team](https://dnsimple.com/feedback), and we'll get you the answers you need.
22 changes: 12 additions & 10 deletions content/articles/zone-ns-records.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,34 +5,36 @@ categories:
- DNS
---

# Updating NS Records for the Zone of a Hosted Domain
# Updating Zone NS Records for a Hosted Domain

You can configure [NS records](/articles/ns-record/) at the apex of a zone of a hosted domain. If you want to configure NS records for a subdomain, click [here](/articles/add-ns-records-for-subdomain/) instead.

<div class="section-steps" markdown="1">
##### Updating NS records for a zone

1. Log in to DNSimple with your user credentials.
1. If you have multiple accounts, select your account in the navigation bar.
1. On the top-nav menu, click the <label>Domain Names</label> tab, locate the relevant domain, and click on the name to access the domain page.
1. Switch to the <label>DNS</label> tab.

![Domain DNS tab link](/files/domain-tab-dns-link.png)
1. Click the <label>Domain Names</label> tab, then locate and click the relevant domain to access the domain page.
1. Click the <label>DNS</label> tab on the left side.
1. Scroll down to locate the Zone NS records section.
1. Click on <label>Edit zone NS records</label>
1. Click <label>Edit zone NS records</label>

<!--- needs screenshot -->
dperrymorrow marked this conversation as resolved.
Show resolved Hide resolved

![Zone NS records](/files/zone-ns-records.png)
1. Enter the hostnames of the name servers you want to set for the NS records in the zone.

![Apply NS records](/files/zone-ns-records-update.png)
1. Instead of typing in name server hostnames, you can also choose to add them from one or more [name server sets](/articles/name-server-sets).
1. You can also add them from one or more [name server sets](/articles/name-server-sets) instead of typing in name server hostnames.

![Apply NS records from name server sets](/files/zone-ns-records-name-server-set.png)
1. Click on <label>Apply NS records</label> to apply the changes.
1. Click <label>Apply NS records</label> to apply the changes.
</div>

<info>
#### Hosted domain must be delegated to DNSimple

The zone NS record changes will only take effect if the domain is [delegated to DNSimple](/articles/delegating-dnsimple-hosted).
</info>

## Have more questions?

You can [contact our support team](https://dnsimple.com/feedback) with any additional questions about configuring or updating zone NS records. We'll be happy to help.