---
title: "Publish a DNSSEC DS record (enable DNSSEC)"
method: POST
path: "/api/domains/{domain}/dnssec"
tags: ["DNS"]
---

# Publish a DNSSEC DS record (enable DNSSEC)

`POST /api/domains/{domain}/dnssec`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/domains/{domain}/dnssec`
- Auth: HTTP bearer

Publishes a delegation-signer (DS) record at the registry, enabling DNSSEC for the domain. Get the DS values from your DNS/zone provider after signing the zone.

## Path parameters

- `domain` string, required

## Request body

- DsRecord: A DNSSEC delegation-signer (DS) record published at the registry.
  - `keyTag` string, required: Key Tag identifying the DNSKEY
  - `algorithm` string, required: DNSSEC algorithm number (e.g. 13 = ECDSAP256SHA256, 8 = RSASHA256)
  - `digestType` string, required: Digest type number (e.g. 2 = SHA-256)
  - `digest` string, required: Hex digest of the DNSKEY

## Response `200`

DS record published

- object
  - `success` boolean
  - `domain` string
  - `enabled` boolean
  - `records` DsRecord[]
    - `keyTag` string, required: Key Tag identifying the DNSKEY
    - `algorithm` string, required: DNSSEC algorithm number (e.g. 13 = ECDSAP256SHA256, 8 = RSASHA256)
    - `digestType` string, required: Digest type number (e.g. 2 = SHA-256)
    - `digest` string, required: Hex digest of the DNSKEY

## Other responses

- `400`: Invalid request parameters
- `401`: Missing or invalid API key
- `403`: Forbidden
- `404`: Domain not found
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)