DNSSEC and moving: disable it first, or take the key with you

DNSSEC puts a signature on the DNS of your domain. The registry holds a fingerprint of the key with which your nameservers sign (the DS record). If you move your domain, or start using different nameservers, that key changes. If the old fingerprint remains, your domain becomes unreachable for a large part of the internet: website and email. In this article you'll read how to prevent that.

Moving your domain to WebOké

1. Turn off DNSSEC at your old provider, preferably a day before the move. This way the old fingerprint disappears at the registry.
2. Move the domain with the transfer code, see How do I move my domain to WebOké?.
3. After the move, we check it ourselves. If the nameservers point to WebOké and the registry still has a key from your old provider that doesn't match our keys, we remove it. This way your domain stays reachable.
4. Turn DNSSEC back on in My WebOké: My Domains, tab DNSSEC/DANE, Activate DNSSEC. See Activating DNSSEC.

Did something still go wrong? Then you'll see a red dot next to DNSSEC under Domain / Email health on the domain page. Click Update key at registry: the correct key will then be set at the registry.

Using other nameservers, such as Cloudflare

1. Turn off DNSSEC in My WebOké: tab DNSSEC/DANE. If DNSSEC is on, you can turn it off there.
2. Wait a day. Other computers remember the old fingerprint for a while: for .nl an hour, for .com and .de a day.
3. Set up the zone at the new provider and change the nameservers, see Using your own or external nameservers for your domain.
4. Turn on DNSSEC at the new provider. They will give you a DS record or a key. Enter it on the left in the DNSSEC/DANE tab and click Save keys locally.

Moving your domain away to another provider

Is your domain moving to another provider and also to other nameservers? Then turn off DNSSEC with us before using the transfer code, and wait a day. Turn it back on with your new provider afterwards. Read more about moving away in Moving a domain away.

Within WebOké to another package or another server

You don't need to do anything for that. If your domain stays on WebOké's nameservers, we turn DNSSEC off ourselves during the move and turn it back on afterwards.

How do you see if something goes wrong?

• Your website works for you, but not for others, or only through a certain internet provider.
• Mail doesn't arrive for some recipients.
• A test on DNSViz or internet.nl reports an error in DNSSEC. With dig yourdomain.nl you'll then see SERVFAIL, see Looking up DNS yourself with nslookup, dig and online tools.