{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "item": { "id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "slug": "confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration", "url": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration.md", "json": "https://update.dsesecurity.com/api/v1/posts/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/" }, "title": "Confirm cross-provider DNSKEY support before planning a Cloudflare DNSSEC-preserving migration", "summary": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:58+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 251, "potentially_affected": "This concerns the documented Cloudflare migration path that preserves DNSSEC.", "dse_recommendation": "DSE recommends obtaining explicit confirmation of external DNSKEY support from both DNS teams before scheduling the cutover.", "primary_source": { "name": "Cloudflare — DNSSEC migration tutorial", "url": "https://developers.cloudflare.com/dns/dnssec/dnssec-active-migration/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Keeping validation active requires cooperation from the previous provider, not only a nameserver change.

\n

Source facts

\n

Cloudflare’s active-DNSSEC migration procedure requires the previous provider to add DNSKEY records at the apex and return them in answers. The workflow cross-imports zone signing keys and checks that both providers return both ZSKs before moving through registrar and provider-removal stages. This is an advanced coordinated migration rather than an ordinary one-step nameserver replacement.

\n

Source: Cloudflare — DNSSEC migration tutorial.

\n

Applicability

\n

This concerns the documented Cloudflare migration path that preserves DNSSEC.

\n

DSE recommendation

\n

DSE recommends obtaining explicit confirmation of external DNSKEY support from both DNS teams before scheduling the cutover. Record current DS records, keys, nameservers, TTLs, and the exact rollback stage. Follow the full provider procedure rather than combining isolated steps from unrelated migrations. Keep the old provider available until the documented trust and delegation transitions have completed and been checked. Give each key-import, DNSKEY-answer, registrar, and provider-removal checkpoint an explicit owner. Preserve the observed key identifiers at every stage. Stop the migration when either provider cannot demonstrate the required shared key set rather than trying to compensate with an early nameserver change.

\n

Verification

\n

In a controlled rehearsal or approved migration, query each authoritative provider for the expected DNSKEY set and inspect the registrar DS state at each stage. Validate representative records through trusted validating resolvers. Record completed checkpoints separately and do not remove the old provider simply because the new dashboard shows the zone as configured.

\n

Official reference

\n

Cloudflare — DNSSEC migration tutorial. Reviewed October 20, 2026.

", "content_text": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.\nSource facts\nCloudflare’s active-DNSSEC migration procedure requires the previous provider to add DNSKEY records at the apex and return them in answers. The workflow cross-imports zone signing keys and checks that both providers return both ZSKs before moving through registrar and provider-removal stages. This is an advanced coordinated migration rather than an ordinary one-step nameserver replacement.\nSource: Cloudflare — DNSSEC migration tutorial.\nApplicability\nThis concerns the documented Cloudflare migration path that preserves DNSSEC.\nDSE recommendation\nDSE recommends obtaining explicit confirmation of external DNSKEY support from both DNS teams before scheduling the cutover. Record current DS records, keys, nameservers, TTLs, and the exact rollback stage. Follow the full provider procedure rather than combining isolated steps from unrelated migrations. Keep the old provider available until the documented trust and delegation transitions have completed and been checked. Give each key-import, DNSKEY-answer, registrar, and provider-removal checkpoint an explicit owner. Preserve the observed key identifiers at every stage. Stop the migration when either provider cannot demonstrate the required shared key set rather than trying to compensate with an early nameserver change.\nVerification\nIn a controlled rehearsal or approved migration, query each authoritative provider for the expected DNSKEY set and inspect the registrar DS state at each stage. Validate representative records through trusted validating resolvers. Record completed checkpoints separately and do not remove the old provider simply because the new dashboard shows the zone as configured.\nOfficial reference\nCloudflare — DNSSEC migration tutorial. Reviewed October 20, 2026.", "content_markdown": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.\n\n## Source facts\n\nCloudflare’s active-DNSSEC migration procedure requires the previous provider to add DNSKEY records at the apex and return them in answers. The workflow cross-imports zone signing keys and checks that both providers return both ZSKs before moving through registrar and provider-removal stages. This is an advanced coordinated migration rather than an ordinary one-step nameserver replacement.\n\nSource: [Cloudflare — DNSSEC migration tutorial](https://developers.cloudflare.com/dns/dnssec/dnssec-active-migration/).\n\n## Applicability\n\nThis concerns the documented Cloudflare migration path that preserves DNSSEC.\n\n## DSE recommendation\n\nDSE recommends obtaining explicit confirmation of external DNSKEY support from both DNS teams before scheduling the cutover. Record current DS records, keys, nameservers, TTLs, and the exact rollback stage. Follow the full provider procedure rather than combining isolated steps from unrelated migrations. Keep the old provider available until the documented trust and delegation transitions have completed and been checked. Give each key-import, DNSKEY-answer, registrar, and provider-removal checkpoint an explicit owner. Preserve the observed key identifiers at every stage. Stop the migration when either provider cannot demonstrate the required shared key set rather than trying to compensate with an early nameserver change.\n\n## Verification\n\nIn a controlled rehearsal or approved migration, query each authoritative provider for the expected DNSKEY set and inspect the registrar DS state at each stage. Validate representative records through trusted validating resolvers. Record completed checkpoints separately and do not remove the old provider simply because the new dashboard shows the zone as configured.\n\n## Official reference\n\n[Cloudflare — DNSSEC migration tutorial](https://developers.cloudflare.com/dns/dnssec/dnssec-active-migration/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "url": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Confirm cross-provider DNSKEY support before planning a Cloudflare DNSSEC-preserving migration", "item": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/#article", "identifier": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "url": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/", "headline": "Confirm cross-provider DNSKEY support before planning a Cloudflare DNSSEC-preserving migration", "description": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.", "abstract": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.", "articleBody": "Keeping validation active requires cooperation from the previous provider, not only a nameserver change.\nSource facts\nCloudflare’s active-DNSSEC migration procedure requires the previous provider to add DNSKEY records at the apex and return them in answers. The workflow cross-imports zone signing keys and checks that both providers return both ZSKs before moving through registrar and provider-removal stages. This is an advanced coordinated migration rather than an ordinary one-step nameserver replacement.\nSource: Cloudflare — DNSSEC migration tutorial.\nApplicability\nThis concerns the documented Cloudflare migration path that preserves DNSSEC.\nDSE recommendation\nDSE recommends obtaining explicit confirmation of external DNSKEY support from both DNS teams before scheduling the cutover. Record current DS records, keys, nameservers, TTLs, and the exact rollback stage. Follow the full provider procedure rather than combining isolated steps from unrelated migrations. Keep the old provider available until the documented trust and delegation transitions have completed and been checked. Give each key-import, DNSKEY-answer, registrar, and provider-removal checkpoint an explicit owner. Preserve the observed key identifiers at every stage. Stop the migration when either provider cannot demonstrate the required shared key set rather than trying to compensate with an early nameserver change.\nVerification\nIn a controlled rehearsal or approved migration, query each authoritative provider for the expected DNSKEY set and inspect the registrar DS state at each stage. Validate representative records through trusted validating resolvers. Record completed checkpoints separately and do not remove the old provider simply because the new dashboard shows the zone as configured.\nOfficial reference\nCloudflare — DNSSEC migration tutorial. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:58+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/confirm-cross-provider-dnskey-support-before-planning-a-cloudflare-dnssec-preserving-migration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Confirm cross-provider DNSKEY support before planning a Cloudflare DNSSEC-preserving migration" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 251, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — DNSSEC migration tutorial", "url": "https://developers.cloudflare.com/dns/dnssec/dnssec-active-migration/" } } ] } }