> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/api-reference/network-services/cloud-dns/dnssec/create-a-dnssec-key.md). # Create a DNSSEC key Enable DNSSEC keys and create associated DNSKEY records for your DNS zone. ```json {"openapi":"3.0.3","info":{"title":"IONOS CLOUD - DNS API","version":"1.18.2"},"tags":[{"name":"DNSSEC","description":"related to DNSSEC"}],"servers":[{"url":"https://dns.de-fra.ionos.com","description":"Frankfurt"}],"security":[{"tokenAuth":[]}],"components":{"securitySchemes":{"tokenAuth":{"type":"apiKey","description":"Please provide header value as 'Bearer ' and don't forget to add 'Bearer' HTTP Authorization Scheme before the token.","name":"Authorization","in":"header"}},"schemas":{"dnssecKeyCreate":{"type":"object","required":["properties"],"properties":{"properties":{"$ref":"#/components/schemas/dnssecKeyParameters"}}},"dnssecKeyParameters":{"type":"object","description":"Parameters used to sign zone.\n","properties":{"keyParameters":{"$ref":"#/components/schemas/keyParameters"},"nsecParameters":{"$ref":"#/components/schemas/nsecParameters"},"validity":{"$ref":"#/components/schemas/validity"}},"required":["keyParameters","nsecParameters","validity"]},"keyParameters":{"type":"object","required":["algorithm"],"description":"Key parameters used to sign the zone.\n","properties":{"algorithm":{"$ref":"#/components/schemas/algorithm"},"kskBits":{"$ref":"#/components/schemas/kskBits"},"zskBits":{"$ref":"#/components/schemas/zskBits"}}},"algorithm":{"type":"string","description":"Algorithm used to generate signing keys (both Key Signing Keys and Zone Signing Keys).","enum":["ECDSAP256SHA256","RSASHA256"]},"kskBits":{"type":"integer","description":"Key signing key length in bits.\nkskBits >= zskBits\n","enum":[1024,2048,4096]},"zskBits":{"type":"integer","description":"Zone signing key length in bits.\n","enum":[1024,2048,4096]},"nsecParameters":{"type":"object","required":["nsecMode","nsec3Iterations","nsec3SaltBits"],"description":"Nsec parameters.\n","properties":{"nsecMode":{"$ref":"#/components/schemas/nsecMode"},"nsec3Iterations":{"$ref":"#/components/schemas/nsec3Iterations"},"nsec3SaltBits":{"$ref":"#/components/schemas/nsec3SaltBits"}}},"nsecMode":{"type":"string","description":"NSEC mode.\n","enum":["NSEC","NSEC3"]},"nsec3Iterations":{"type":"integer","description":"Number of iterations for NSEC3. (between 0 and 50)\n","minimum":0,"maximum":50},"nsec3SaltBits":{"type":"integer","description":"Salt length in bits for NSEC3. (between 64 and 128, multiples of 8)\n","minimum":64,"maximum":128},"validity":{"type":"integer","description":"Signature validity in days\n","minimum":90,"maximum":365},"dnssecKeyReadCreation":{"type":"object","required":["id","type","href","properties"],"properties":{"properties":{"$ref":"#/components/schemas/dnssecKeyParameters"},"id":{"type":"string"},"type":{"type":"string","enum":["dnsseckeys"]},"href":{"type":"string","format":"uri","readOnly":true}}},"Error":{"type":"object","additionalProperties":false,"properties":{"httpStatus":{"type":"integer","description":"HTTP status code of the operation as specified by [RFC 7231](https://datatracker.ietf.org/doc/html/rfc7231#section-6).\n"},"messages":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"errorCode":{"type":"string","description":"Internal error code.\n"},"message":{"type":"string","description":"Human readable explanation of the issue.\n"}}}}}}},"responses":{"BadRequest":{"description":"### Bad Request\nThe request send to the API was malformed.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"Unauthorized":{"description":"### Unauthorized\nThe request is missing authorization information or the authorization information provided are expired.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotAllowed":{"description":"### Not Allowed\nThe user issuing the request does not have the needed permissions.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"### Not Found\nThe resource that was requested could not be found.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ConflictErrorDNSSEC":{"description":"### Conflict Error\nYou can only have one DNSSEC per zone, and this zone already has one in place.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"UnprocessableEntity":{"description":"### Unprocessable Entity\nThe request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalError":{"description":"### Internal Server Error\nAn internal error occurred. We apologize for the inconvenience!\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/zones/{zoneId}/keys":{"post":{"operationId":"zonesKeysPost","description":"Enable DNSSEC keys and create associated DNSKEY records for your DNS zone.\n","summary":"Create a DNSSEC key","parameters":[{"name":"zoneId","in":"path","schema":{"type":"string","format":"uuid"},"required":true,"description":"The ID (UUID) of the DNS zone."}],"tags":["DNSSEC"],"requestBody":{"description":"Enable DNSSEC request.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/dnssecKeyCreate"}}}},"responses":{"202":{"description":"Successful operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/dnssecKeyReadCreation"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/NotAllowed"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/ConflictErrorDNSSEC"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"500":{"$ref":"#/components/responses/InternalError"}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ionos.com/cloud/api-reference/network-services/cloud-dns/dnssec/create-a-dnssec-key.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.