DNSSEC keys can be rotated periodically so a domain does not rely indefinitely on the same signing key. cPanel currently recommends rotating a domain's DNSSEC keys yearly.
Rotation requires coordination with the registrar. Do not delete the old key before the new DS information has been published and allowed to propagate.
- Open cPanel → Domains → Zone Editor → DNSSEC for the domain.
- Create a new DNSSEC key.
- Open the new key's View DS Records information.
- At the domain registrar, add the new DS information that matches the new key.
- Allow the new DS record to propagate. cPanel's key-rotation guidance uses a 24–48 hour waiting period.
- Remove the old DS information from the registrar.
- Return to cPanel and delete the old DNSSEC key only after the registrar no longer relies on it.
- Validate the domain with a DNSSEC-aware testing tool.
During the overlap period, keep the old key available until the new chain of trust is established. This avoids creating a window where validating resolvers cannot authenticate the zone.
