# DNS Security

DNS / DNS Security

## Enable DNSSEC security key

 - [GET /DNSSEC/activate_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/activate_zone_key.md): This function activates a DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Create DNSSEC security key

 - [GET /DNSSEC/add_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/add_zone_key.md): This function generates a DNSSEC zone key for a domain.

Note:

* After you enable DNSSEC on the domain, you must add the DS records to your registrar.
* You cannot modify the DNSSEC security key. To make any changes, you must disable (and delete) and re-create the DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Disable DNSSEC security key

 - [GET /DNSSEC/deactivate_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/deactivate_zone_key.md): This function deactivates a DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Disable DNSSEC

 - [GET /DNSSEC/disable_dnssec](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/disable_dnssec.md): This function disables DNSSEC on the domain.

Warning:

 * This action is irreversible. If you disable DNSSEC on the domain, you will lose the associated keys. You can only retrieve the previous state with a full backup.
 * If you disable DNSSEC, you must remove the DNS records at the registrar.

Important:

  When you disable the DNS role, the system disables this function.

## Enable DNSSEC

 - [GET /DNSSEC/enable_dnssec](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/enable_dnssec.md): This function enables DNSSEC on the domain.

Note:

 * After you enable DNSSEC on the domain, you must add the DNS records to your registrar.
 * You cannot modify the DNSSEC security key. To make any changes, you must disable (and delete) and re-create the DNSSEC security key.

Important:

  When you disable the DNS role, the system disables this function.

## Export DNSKEY record value

 - [GET /DNSSEC/export_zone_dnskey](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/export_zone_dnskey.md): This function exports a domain's DNSKEY record value.

Important:

When you disable the _DNS_ role, the system disables this function.

## Export DNSSEC security key

 - [GET /DNSSEC/export_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/export_zone_key.md): This function exports a DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Return domain's DS records

 - [GET /DNSSEC/fetch_ds_records](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/fetch_ds_records.md): This function fetches a domain's Delegation of Signing (DS) records.

Important:

When you disable the DNS role, the system disables this function.

## Add DNSSEC security key

 - [GET /DNSSEC/import_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/import_zone_key.md): This function imports a DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Remove DNSSEC security key

 - [GET /DNSSEC/remove_zone_key](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/remove_zone_key.md): This function removes a DNSSEC security key.

Important:

When you disable the DNS role, the system disables this function.

## Update domain to use NSEC3

 - [GET /DNSSEC/set_nsec3](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/set_nsec3.md): This function configures the domain to use Next Secure Record 3 (NSEC3) semantics.

Important:

  When you disable the DNS role, the system disables this function.

## Update domain to use NSEC

 - [GET /DNSSEC/unset_nsec3](https://api.docs.cpanel.net/specifications/cpanel.openapi/dns-security/unset_nsec3.md): This function configures the domain to use Next Secure Record (NSEC) semantics instead of Next Secure Record 3 (NSEC3) semantics.

Important:

  When you disable the DNS role, the system disables this function.