Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We at are being pressured to implement DNSSEC by a sub-division of our organisation:

Our current name servers and are unsigned, non-dnssec servers.

We would like to use as a hidden master and implement inline signing in bind as per: Example #2 . Our new DNSSEC enabled servers for will be and

We would like to publish the DS records to the .com registrar so that we can internally test the new DNSSEC servers. The SOA would remain (And the NS records would not include the DNSSEC servers for the time being).

My question is:

If we publish DS records to .com for our DNSSEC servers, will dnssec-validating DNS servers break when they realize there is no DNSSEC functionality at or


Are there any other side effects we should be on the lookout for with this hybrid setup?

share|improve this question
up vote 3 down vote accepted

If you publish DS records in the tld zone and your public nameservers do not support DNSSEC then your records will fail validation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.