# Enable DNSSEC on domain

This function enables DNSSEC on the domain.



* Only servers that run PowerDNS can use DNSSEC. If you call this function on a server that doesn't use PowerDNS, you will receive an error.
* After you enable DNSSEC on the domain, you  add the Delegation of Signing (DS) records on your DNS server and with your registrar.
* You  modify the DNSSEC security key. To make any changes, you  disable, delete, and re-create the DNSSEC security key.

Endpoint: GET /enable_dnssec_for_domains
Version: 11.134.0.5
Security: BasicAuth

## Query parameters:

  - `domain` (string, required)
    The domain for which to enable DNSSEC.



To enable DNSSEC on multiple domains, duplicate or increment the parameter name. For example, to check three domains, you could:
* Use the  parameter multiple times.
* Use the , , and  parameters.
    Example: "example.com"

  - `active` (integer)
    Whether to activate the newly-created key.
*  - Activate the key.
*  - Do  activate the key.
    Enum: 0, 1

  - `algo_num` (integer)
    The algorithm that the system uses to generate the security key.
*  - RSA/SHA-1
*  - DSA-NSEC3-SHA1
*  - RSASHA1-NSEC3-SHA1
*  - RSA/SHA-256
*  - RSA/SHA-512
*  - ECDSA Curve P-256 with SHA-256
*  - ECDSA Curve P-384 with SHA-384



We recommend that you use an ECDSA Curve P-256 with SHA-256 (13) value if your registrar supports it.
    Enum: 5, 6, 7, 8, 10, 13, 14

  - `key_setup` (string)
    The manner in which the system creates the security key.
*  - Use separate keys for KSK and ZSK. Use this value when the  parameter is equal to or less than 8.
*  - Use a single key for both KSK and ZSK. Use this value when the  parameter is greater than 8.
    Enum: "classic", "simple"

  - `nsec3_iterations` (integer)
    The number of times that the system rehashes the first resource record hash operation.
    Example: 7

  - `nsec3_narrow` (integer)
    Whether NSEC3 operates in Narrow or Inclusive mode.



For information about these modes, read PowerDNS's DNSSEC documentation.

*  - Narrow mode.
*  - Inclusive mode.
    Enum: 0, 1

  - `nsec3_opt_out` (integer)
    Whether the system will create records for all delegations.
*  - Create records for all delegations.
*  - Create records only for secure delegations.



Only use the  value if you  create records for all delegations.
    Enum: 0, 1

  - `nsec3_salt` (string)
    A hexadecimal string that the system appends to the domain name before it applies the hash function to the name.



For information about salt values, read RFC 5155.
    Example: "1a2b3c4d5e6f"

  - `use_nsec3` (integer)
    Whether the domain will use Next Secure Record (NSEC) or NSEC3 semantics.
*  - Use NSEC3 semantics.
*  - Use NSEC semantics.



If you use this value, the system ignores the other NSEC3 options.
    Enum: 0, 1

## Response 200 fields (application/json):

  - `data` (object)

  - `data.domains` (array)
    An array of objects that contains information about each domain.

  - `data.domains.domain` (string)
    The domain for which the system enabled DNSSEC.
    Example: "example.com"

  - `data.domains.enabled` (integer)
    Whether the system enabled DNSSEC.
*  - Enabled.
*  - The system failed to enable DNSSEC.



This function will  return the  and  returns if this return is a  value.
    Enum: 0, 1

  - `data.domains.new_key_id` (string)
    The assigned security key ID. A valid ID.
    Example: "2"

  - `data.domains.nsec_error` (string)
    The domain has a NSEC3 configuration error.



The function  displays this return if there is a NSEC3 configuration error. An error message.
    Example: "Error message."

  - `data.domains.nsec_version` (string)
    The version of DNSSEC the system used.
* 
* 



The function only displays this return if there is a NSEC3 configuration error. The system also returns the error in the  return.
    Enum: "NSEC3", "NSEC"

  - `metadata` (object)

  - `metadata.command` (string)
    The method name called.
    Example: "enable_dnssec_for_domains"

  - `metadata.reason` (string)
    The reason the API function failed when the  field is . This field may display a success message when a function succeeds.
    Example: "OK"

  - `metadata.result` (integer)
    *  - Success.
*  - Failed. Check the  field for more details.
    Enum: 0, 1

  - `metadata.version` (integer)
    The version of the API function.
    Example: 1