Plesk doesn't sign zones out of the box. DNSSEC comes from the Plesk DNSSEC extension, which adds per-domain signing, automatic ZSK rollover, and DS-record notifications on top of the BIND server Plesk already runs. Unlike cPanel's single-key model (covered in enabling DNSSEC on cPanel), Plesk uses a split KSK/ZSK design, and that changes how you plan rollovers.
This guide is for admins running Plesk Obsidian on Linux who want signed zones across a customer base without taking domains offline. It covers licensing, default policy, signing from the GUI and CLI, publishing DS records, and the unsign order that avoids an outage.
Requirements and licensing
- Plesk Obsidian 18.0.60 or later. Older builds can't install the current extension.
- BIND as the local DNS server on Linux (Microsoft DNS on Windows). If you've switched DNS off in Plesk, or hand zones to an external provider through a DNS extension, the DNSSEC extension has nothing to sign.
- Edition. The extension is free on Web Pro and Web Host. On Web Admin it's a paid add-on — see the Plesk license tiers breakdown if you're deciding whether to step up.
Install the extension
From the GUI: Extensions → Extensions Catalog, search for "DNSSEC", click Get It Free (or Buy on Web Admin). From the shell:
plesk bin extension --install dnssec
plesk ext dnssec --version
The extension ID is dnssec, which is also the namespace for its CLI (plesk ext dnssec).
Understand the KSK/ZSK split
Plesk generates two kinds of keys per zone:
| Key | Signs | Rollover | Your action on rollover |
|---|---|---|---|
| KSK (Key Signing Key) | The DNSKEY RRset | Long — typically a year or more | Update the DS record at the registrar |
| ZSK (Zone Signing Key) | Every other RRset | Shorter | None — Plesk rolls it automatically |
The point of the split is that the frequent rotation (ZSK) never touches the registrar, and the one that does (KSK) happens rarely. Plesk runs more than one key of each type at a time during rollovers — a modified Double-RRset method for the KSK — so old and new keys overlap until caches catch up, and obsolete keys are removed automatically.
The ZSK transition constraint
Each ZSK rollover has a transition period of 30 days, or SOA TTL + SOA Expire if that sum is longer. That period can't exceed half the ZSK rollover period. In practice:
- The ZSK rollover period must be at least 60 days.
- If you've raised a zone's SOA Expire to something like 4 weeks and TTL to a day, the transition grows past 30 days and the minimum ZSK period grows with it.
Plesk refuses settings that break this rule, but it's easier to plan for it than to debug the validation error.
Set the server-wide defaults
Go to Tools & Settings → Extensions → DNSSEC (or Extensions → My Extensions → DNSSEC → Open). The defaults here apply whenever someone signs a zone without overriding them.
A sensible policy for shared hosting:
- Algorithm:
ECDSAP256SHA256(algorithm 13). Small signatures, universal resolver support, and it matches what most registrars expect.ED25519is smaller still, but a few registrar DS forms still don't list algorithm 15. - KSK rollover: 1 year. Every KSK roll means a DS update at the registrar, so keep this long.
- ZSK rollover: 3 months. It's automatic, so the cost is CPU and zone size, not admin time.
Avoid RSASHA512 and 4096-bit keys on busy servers. RSA signatures inflate responses, push DNSKEY answers towards the UDP fragmentation limit, and make zone re-signing noticeably slower on a 2-vCPU VPS with a few hundred zones.
Sign a zone
From the GUI
Websites & Domains → example.com → DNSSEC → Sign the DNS Zone. On the first signing Plesk generates a fresh KSK and ZSK pair using the server defaults, or custom values if you expand the settings. On a re-sign it asks whether to reuse the previous keys or generate new ones — reuse them if the DS record at the registrar is still in place.
When signing completes Plesk displays the DS records with a copy button. Customers with DNS access on their subscription see the same screen, so they can self-serve.
From the CLI
plesk ext dnssec sign --domain-name example.com \
--encryption-algorithm ECDSAP256SHA256 \
--ksk-expiration 1 --ksk-expiration-unit years \
--zsk-expiration 3 --zsk-expiration-unit months
plesk ext dnssec info --domain-name example.com
info prints the zone's current keys, algorithm, and rollover settings. To sign every domain on the server with the defaults:
for d in $(plesk bin domain --list); do
plesk ext dnssec sign --domain-name "$d"
done
Run this only for domains whose DNS Plesk actually serves. Signing a zone that the world resolves elsewhere does no harm, but it generates DS records nobody should publish.
Publish the DS record
Signing alone changes nothing for validating resolvers — until the parent zone carries a DS record, they treat the domain as unsigned. Confirm the zone is serving signed data first:
dig +dnssec +noall +answer DNSKEY example.com @127.0.0.1
You should see two or more DNSKEY records (KSK flag 257, ZSK flag 256) with their RRSIGs. Then add the DS record at the registrar — key tag, algorithm, digest type, and digest, pasted exactly. If the parent zone is also on the same Plesk server (a subdomain zone, for example), add it as a DS record in the parent domain's DNS Settings instead.
Verify the chain from outside:
dig +noall +answer DS example.com @1.1.1.1
dig +dnssec example.com SOA @1.1.1.1 | grep flags
An ad flag in the second response means the chain validates end to end. SERVFAIL means the DS and DNSKEY don't match — usually a mistyped digest or the wrong algorithm number in the registrar form.
Handle KSK rollovers
Plesk emails the domain owner when a KSK rollover needs a DS update. The notification text can't be customised, which matters if your customers aren't used to DNS jargon — send your own explanation alongside it. You get one KSK rollover period to publish the new DS record before the old key is retired. With a 1-year KSK that's generous. With a 30-day KSK, a customer on holiday takes their domain offline.
For domains where you control the registrar account — common when you sell domains through Blesta's registrar modules — script the DS update against the registrar API rather than relying on the email.
Unsign a zone safely
Order matters here. Plesk's own warning is that the domain stops resolving if a DS record stays in the parent after the zone is unsigned.
- Remove the DS record at the registrar.
- Wait for the parent's DS TTL to expire — check with
dig DS example.com @1.1.1.1until it returns nothing, then give it one more TTL. - Unsign: Websites & Domains → example.com → DNSSEC → Unsign, or:
plesk ext dnssec unsign --domain-name example.com
Plesk keeps the keys after unsigning, so re-signing later can reuse them. This is also the correct sequence before migrating a domain off Plesk: unsign at the source, move, then sign at the destination and publish its new DS.