---
title: DNSSEC
---

[Skip to content](#%5Ftop) 

[API Reference](https://developers.cloudflare.com/api/typescript)

[DNS](https://developers.cloudflare.com/api/typescript/resources/dns)

Copy Markdown

Open in **Claude**

Open in **ChatGPT**

Open in **Cursor**

---

**Copy Markdown**

**View as Markdown**

# DNSSEC

##### [DNSSEC Details](https://developers.cloudflare.com/api/typescript/resources/dns/subresources/dnssec/methods/get)

client.dns.dnssec.get(DNSSECGetParams { zone\_id } params, RequestOptionsoptions?): [DNSSEC](https://developers.cloudflare.com/api/typescript/resources/dns#%28resource%29%20dns.dnssec%20%3E%20%28model%29%20dnssec%20%3E%20%28schema%29) { algorithm, digest, digest\_algorithm, 11 more } 

GET/zones/{zone\_id}/dnssec

##### [Edit DNSSEC Status](https://developers.cloudflare.com/api/typescript/resources/dns/subresources/dnssec/methods/edit)

client.dns.dnssec.edit(DNSSECEditParams { zone\_id, dnssec\_multi\_signer, dnssec\_presigned, 2 more } params, RequestOptionsoptions?): [DNSSEC](https://developers.cloudflare.com/api/typescript/resources/dns#%28resource%29%20dns.dnssec%20%3E%20%28model%29%20dnssec%20%3E%20%28schema%29) { algorithm, digest, digest\_algorithm, 11 more } 

PATCH/zones/{zone\_id}/dnssec

##### [Delete DNSSEC records](https://developers.cloudflare.com/api/typescript/resources/dns/subresources/dnssec/methods/delete)

client.dns.dnssec.delete(DNSSECDeleteParams { zone\_id } params, RequestOptionsoptions?): [DNSSECDeleteResponse](https://developers.cloudflare.com/api/typescript/resources/dns#%28resource%29%20dns.dnssec%20%3E%20%28model%29%20dnssec%5Fdelete%5Fresponse%20%3E%20%28schema%29)

DELETE/zones/{zone\_id}/dnssec

##### ModelsExpand Collapse 

DNSSEC { algorithm, digest, digest\_algorithm, 11 more } 

algorithm?: string | null

Algorithm key code.

digest?: string | null

Digest hash.

digest\_algorithm?: string | null

Type of digest algorithm.

digest\_type?: string | null

Coded type for digest algorithm.

dnssec\_multi\_signer?: boolean

If true, multi-signer DNSSEC is enabled on the zone, allowing multiple providers to serve a DNSSEC-signed zone at the same time. This is required for DNSKEY records (except those automatically generated by Cloudflare) to be added to the zone.

See [Multi-signer DNSSEC](https://developers.cloudflare.com/dns/dnssec/multi-signer-dnssec/) for details.

dnssec\_presigned?: boolean

If true, allows Cloudflare to transfer in a DNSSEC-signed zone including signatures from an external provider, without requiring Cloudflare to sign any records on the fly.

Note that this feature has some limitations. See [Cloudflare as Secondary](https://developers.cloudflare.com/dns/zone-setups/zone-transfers/cloudflare-as-secondary/setup/#dnssec) for details.

dnssec\_use\_nsec3?: boolean

If true, enables the use of NSEC3 together with DNSSEC on the zone. Combined with setting dnssec\_presigned to true, this enables the use of NSEC3 records when transferring in from an external provider. If dnssec\_presigned is instead set to false (default), NSEC3 records will be generated and signed at request time.

See [DNSSEC with NSEC3](https://developers.cloudflare.com/dns/dnssec/enable-nsec3/) for details.

ds?: string | null

Full DS record.

flags?: number | null

Flag for DNSSEC record.

key\_tag?: number | null

Code for key tag.

key\_type?: string | null

Algorithm key type.

modified\_on?: string | null

When DNSSEC was last modified.

formatdate-time

public\_key?: string | null

Public key for DS record.

status?: "active" | "pending" | "disabled" | 2 more

Status of DNSSEC, based on user-desired state and presence of necessary records.

One of the following:

"active"

"pending"

"disabled"

"pending-disabled"

"error"

DNSSECDeleteResponse \= string

#### DNSSECZsk

##### [List DNSSEC ZSKs](https://developers.cloudflare.com/api/typescript/resources/dns/subresources/dnssec/subresources/zsk/methods/list)

client.dns.dnssec.zsk.list(ZskListParams { zone\_id } params, RequestOptionsoptions?): SinglePage<[ZskListResponse](https://developers.cloudflare.com/api/typescript/resources/dns#%28resource%29%20dns.dnssec.zsk%20%3E%20%28model%29%20zsk%5Flist%5Fresponse%20%3E%20%28schema%29) { DNSKEY, Location, Name, 2 more } \>

GET/zones/{zone\_id}/dnssec/zsk

##### ModelsExpand Collapse 

ZskListResponse { DNSKEY, Location, Name, 2 more } 

DNSKEY?: DNSKEY { Algorithm, Flags, Hdr, 2 more } 

Algorithm?: number | null

Flags?: number | null

Hdr?: Hdr { Class, Name, Rdlength, 2 more } 

Class?: number | null

Name?: string | null

Rdlength?: number | null

Rrtype?: number | null

Ttl?: number | null

Protocol?: number | null

PublicKey?: string | null

Location?: "database" | "vault"

Storage backend where the DNSSEC key material is stored.

One of the following:

"database"

"vault"

Name?: string

Internal key name for the ZSK.

SigningKey?: SigningKey { kek, privkey, pubkey } 

kek?: string | null

Key encryption key name used to encrypt the private key.

privkey?: string | null

Encrypted private key material for the signing key.

formatbyte

pubkey?: string | null

Public key content associated with the signing key.

Tag?: "active" | "publish" | "external" | 3 more

Lifecycle state tag attached to the DNSSEC key.

One of the following:

"active"

"publish"

"external"

"retired"

"revoked"

"removed"