Prompt: turn on dnssec for a .ro domain

Have an agent sign a .ro domain the right way for where its zone lives: on ird DNS it is one switch (ird dns dnssec), on your own or another host's nameservers it means publishing the DS records at the .ro registry yourself — then prove validation with dig and delv, keep the one ordering rule that stops a signed domain from going dark, and have the rollback ready.

Needs: the ird CLI, logged in (ird dns dnssec and ird domains dsdata are CLI-only); for external nameservers, the DS values your DNS host shows for the zone; dig and delv in a shell Costs: each DNSSEC or DS change at the registry (credits_prices → domains.dnssec.per_change); an ird-hosted zone keeps its hourly fee (recurring.dns-zone-hourly); the book prices only per_change Group: domains & dns

Paste everything below the line into a fresh conversation. Fill in the FILL IN block first.

Task

Enable (or check, or roll back) DNSSEC for DOMAIN. Every registry change is shown to me before it is sent; no nameserver is touched.

FILL IN

DOMAIN:      example.ro
WHERE:       ird               # ird = the zone is hosted on ird DNS | external = my own or another host's nameservers
ACTION:      enable            # enable | status | rollback
DS_RECORDS:                    # external only, one per line as the host shows them: <keytag> <alg> <digest-type> <digest>

Non-negotiable rules

1. DNSSEC then a nameserver move = dark domain. A DS at the registry says "answers must be signed with this key"; servers without it are dropped by every validating resolver. Never change nameservers while a DS is published: withdraw, wait until the parent stops returning it, then move.
2. Confirm each registry change. Show the exact dnssec or dsdata command and wait for a yes. dsdata add publishes exactly what you type — a typo in a digest is a dark domain too.
3. A DS must match a served key. External route: dig DNSKEY at the host must return keys before any DS is published.
4. No loops. Registry and parent checks once when I ask; the help gives no timing.
5. WHERE must match reality. Decide the route from the live nameservers (step A); say so if FILL IN disagrees.

Steps

A. Facts. list_domains (CLI: ird domains list) → DOMAIN's nameservers and dsdata. dns_list_zones and, if listed, dns_get_zone(domain=DOMAIN) → the nameservers ird publishes the zone on. Equal to the registry's → ird route; otherwise external. ird domains dsdata list DOMAIN → what is published now. dig +short DNSKEY DOMAIN @<nameserver> → whether the host already signs. ACTION status: add step E, report.

B. ird route (enable). ird dns dnssec DOMAIN status first, then ird dns dnssec DOMAIN on (domains.dnssec.per_change). Its help says only "DNSSEC for a zone hosted on ird DNS" with on|off|status; the dsdata help adds that DS publishing is "only needed when you run DNSSEC on external nameservers — if your DNS is hosted with ird, just use ird dns dnssec <domain> on". So on should cover the registry; neither help states it outright. After it returns: ird dns dnssec DOMAIN status and ird domains dsdata list DOMAIN. A DS listed = done, go to D. status showing DS values but dsdata list empty = ask me before publishing them with step C, exactly those values.

C. External route (enable). DS_RECORDS blank = stop. Check dig +short DNSKEY DOMAIN @<external nameserver> returns keys (rule 3). Then, one confirmed command per line: ird domains dsdata add DOMAIN <keytag> <alg> <digest-type> <digest>. ird domains dsdata list DOMAIN must echo each.

D. Wait for the parent. dig +short DS DOMAIN @1.1.1.1 — empty until the .ro zone publishes it. Once when I ask; don't loop.

E. Verify. From a validating resolver: dig +dnssec A DOMAIN @1.1.1.1 → the ad flag in the header and an RRSIG in the answer; delv @1.1.1.1 DOMAIN A → "fully validated"; dig +short DS DOMAIN → the DS. External route: delv +root DOMAIN A too. "bogus" or no ad → report; add no more DS records.

F. Rollback (ACTION rollback, or on any failure in E). ird route: ird dns dnssec DOMAIN off, then ird domains dsdata list DOMAIN — if a DS is still listed, withdraw it in the next line. External route: ird domains dsdata delete DOMAIN <keytag> <alg> <digest-type> <digest> for each entry of dsdata list. Then dig +short DS DOMAIN @1.1.1.1 until empty (once per request from me) — only after that may nameservers change. Keys stay served at the host; that is harmless.

G. Moving nameservers later. Order, always: dsdata delete (or dnssec off) → parent returns no DS and the DS TTL from dig DS DOMAIN has passed → the move (own-nameservers-glue or leave-ird-dns prompt) → sign at the new host → publish the new DS.

Deliverable

The route taken (ird / external) and why, the DS records now at the registry as dsdata list shows them, the dig +dnssec header flags and the delv verdict, the rollback commands with the exact DS values filled in, and the ordering rule from G restated.