POST - Create a DS record in a Zone

Purpose

This API adds a DS (Delegation Signer) record under a specified DNS zone. DS records are used in DNSSEC (Domain Name System Security Extensions) to create a chain of trust between a parent and child zone, ensuring DNS responses are authenticated and not tampered with. It strengthens DNS security by ensuring authenticity and integrity of DNS responses, Protects against cache poisoning attacks and unauthorized DNS modifications, and enables seamless integration of DNSSEC keys into managed DNS environments..This API simplifies the addition of DS records, ensuring enhanced DNS security and compliance with DNSSEC best practices.

Request URL

Method: POST

https://{appconsole_IP}:{9443}/api/dns/zone/{zone_pk}/DS/

Request Headers

The following headers must be included in the API request for successful authentication and data submission:

Authorization: DDI Central's OAuth implementation uses the Bearer authentication scheme. Hence, while making API calls, access_token obtained via the OAuth 2.0 Client Credentials Grant must be included in the Authorization header of API requests. This token verifies the client’s identity and ensures appropriate permissions for accessing resources.

The Authorization Header follows the format below:

headers = { "Authorization": "Bearer {bearer_tk}" }


Content-Type: Required in the header to indicate the media type of the resource being sent. It helps the server at the receiving end understand how to process the transmitted request body.

The Content-Type Header follows the format below:

headers ={ "Content-Type": "application/json" }

Path Parameters

  • zone_pk* long
    • Specifies the unique identifier of the DNS zone where the DS record will be added.
    • Example: 5867.

Request Body

  • domain_name* string
    • The subdomain or domain where the DS record will be applied.
    • Example: "ds35.hellotest109.com.".
  • domain_ttl* integer
    • Time-to-live (TTL) value in seconds, determining how long the record is cached.
    • Example: 86400 (1 day).
  • zone_name* string
    • The DNS zone where the DS record will be added.
    • Example: "hellotest109.com.".
  • cluster_name* string
    • Name of the cluster managing this DNS zone.
    • Example: "newcluster7".
  • records* an array of string
    • List of DS records associated with the domain. Each record object contains:
    • keyTag: The key tag identifying the DNSSEC key.
    • algorithm: The cryptographic algorithm used for signing.
    • digestType: The digest type specifying the hash algorithm.
    • digest: The hashed value representing the DNSKEY record.
    • Example:
      • [ { "keyTag": 2, "algorithm": 5, "digestType": 4, "digest": "81427470f1c5765d537e2a54b3782b0c519dcf19cd1156a2b67f668fd3f4e94ad36e737b3992ebec64a695fc2d1a670f" } ]

 

* - Mandatory parameter.

 

Sample Request

Copied
{
   "domain_name":"ds35.hellotest109.com.",
   "domain_ttl":86400,
   "zone_name":"hellotest109.com.",
   "cluster_name":"newcluster7",
   "records":[
      {
         "keyTag":2,
         "algorithm":5,
         "digestType":4,
         "digest":"81427470f1c5765d537e2a54b3782b0c519dcf19cd1156a2b67f668fd3f4e94ad36e737b3992ebec64a695fc2d1a670f"
      }
   ]
}

Sample Response

Copied
{
   "domain_name":"ds35.hellotest109.com.",
   "domain_ttl":86400,
   "zone_name":"hellotest109.com.",
   "cluster_name":"newcluster7",
   "records":[
      {
         "keyTag":2,
         "algorithm":5,
         "digestType":4,
         "digest":"81427470f1c5765d537e2a54b3782b0c519dcf19cd1156a2b67f668fd3f4e94ad36e737b3992ebec64a695fc2d1a670f"
      }
   ]
}