DNSSEC on Windows Server 2022 (DNS) - Get DS Records

Faisal Rashid 65 Reputation points
2023-12-14T20:09:14.6+00:00

Hello!

I have two Windows Server 2022 machines with DNS role on both. They are going to be the authoritative name servers for a domain name on the internet. I have set the first as the primary name server and second as the secondary name server. There is no active directory setup on both machines. The secondary server successfully receives zone updates from the primary server. It works fine to resolve DNS over the internet.

I now want to setup DNSSEC for the domain, for security reasons. So I have signed the zone in DNS by right clicking and selecting DNSSEC and working through the manager and the zone has been successfully signed. But now I need to tell the internet users to use DNSSEC, so I need the following information to place at the domain registry under DS records settings:

Key Tag, Algorithm, Digest Type and Digest.

There is nothing I can see in any of the records placed in the zone that show this information. There is also nothing in the right click > DNSSEC > Properties that allows me to generate or see the DS records. Do I have to do this through PowerShell and how?

Does anyone know how to generate DS records for a signed DNSSEC domain that are compatible with an internet registry such as GoDaddy? (I need to generate to DS records per domain for good practice)

Many Thanks!

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,664 questions
{count} votes

Accepted answer
  1. Hania Lian 21,191 Reputation points Microsoft Vendor
    2024-01-15T02:45:16.0933333+00:00

    Hello, Please try below PowerShell command to export DNSSec related information:

    1. Open PowerShell as administrator and run dnscmd [<servername>] /zoneexport <zonename> <zoneexportfile>
    2. Nagivate to the folder where you exported the dns zone, and you will find the file which should contain the DS records for your signed zone. REF: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd#syntax-26 Best Regards,
      Hania Lian ============================================ If the Answer is helpful, please click "Accept Answer" and upvote it.
    1 person found this answer helpful.
    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Faisal Rashid 65 Reputation points
    2023-12-14T20:58:34.47+00:00
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.