Procedure for security measures DNSSEC

Version 2.1, 26. April, 2023


1. About security measures for a .dk domain name

1.1 According to sections 6.2 and 6.3 of Punktum dk’s terms and conditions for the right of use to a .dk domain name, a registrar, a name server manager, or the registrant of a .dk domain name may handle the security measures for a domain name. This procedure describes the security measures in question and provides instructions for handling security measures.

2. DNSSEC

2.1 Security measures refer to DNSSEC (Domain Name System Security Extensions), which is a service that verifies the correctness of the response to a DNS query. This means - for example - that visitors on a website can be sure that they are visiting the right website and have not been redirected to a fake site.

3. Attending to DNSSEC

3.1 A registrant can have the name server manager for the name servers to which the registrant's domain name is connected attend to DNSSEC.

3.2 If the registrant has chosen registrant management of his or her domain name, cf. section 2.1 of Terms and conditions for the right of use to a .dk domain name, the registrant or his or her proxy may choose to attend to DNSSEC themselves in so far as it is permitted by technical trade standards.

3.3 Attending to DNSSEC includes:

  1. Generating key sets (private and public encryption key) for use with DNSSEC.
  2. Registration of a public encryption key in Punktum dk’s system.
  3. Publishing one or more public encryption keys in DNS.
  4. Generating and publishing signatures whose content is encrypted by using encryption keys.
  5. Maintenance of encryption keys

3.4 The registrant or his or her proxy can attend to DNSSEC for a domain name by using Punktum dk’s self-service, which can be found at the address: https://self-service.punktum.dk/ or DSU.

The name server manager assigns keys using Punktum dk’s self-service portal or DSU. If the name server manager is also the registrar, he or she may also use EPP or Punktum dk’s registrar portal.

The technical information on Punktum dk’s website provides further details on the above-mentioned methods.

3.5 When name servers are changed for a domain name with associated DNSSEC keys, the existing DNSSEC keys will be removed and DNSSEC service thus be interrupted, until the new name server manager assigns new DNSSEC keys with Punktum dk.

This procedure is laid down in accordance with section 14(1) of the Danish Domain Names Act. Punktum dk A/S is obliged to observe good domain name practice in the laying down of this procedure; see section 14(3) of the Danish Domain Names Act.