# DNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parent

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/route53-dnssec-signing

Recipe id: `route53-dnssec-signing` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- control `sc-20`

## Collection

Kind: `cli`

```sh
# public-hosted-zones
aws route53 list-hosted-zones --query 'HostedZones[?Config.PrivateZone==`false`].{Id:Id,Name:Name}'
# public-zone-dnssec
aws route53 get-dnssec --hosted-zone-id <PUBLIC_ZONE_ID>
# domain-dnssec-keys
aws route53domains get-domain-detail --region us-east-1 --domain-name <DOMAIN> --query 'DnssecKeys'
```

## Expected output

One get-dnssec response per public hosted zone under the projection root public-zone-dnssec: Status.ServeSignature (SIGNING | NOT_SIGNING | DELETING | ACTION_NEEDED | INTERNAL_FAILURE) and KeySigningKeys[] with Status (ACTIVE | INACTIVE | DELETING | ACTION_NEEDED | INTERNAL_FAILURE), DSRecord, DNSKEYRecord, KeyTag and KmsArn. get-domain-detail returns DnssecKeys[] with the Digest, KeyTag, Algorithm and Flags actually lodged at the registry.

## Assertions

- {"field":"public-zone-dnssec.Status.ServeSignature","op":"eq","value":"SIGNING","controls":["sc-20"],"description":"Every public hosted zone is serving DNSSEC signatures, so authoritative responses carry data-origin authentication and integrity artifacts."}
- {"field":"public-zone-dnssec.KeySigningKeys[].Status","op":"eq","value":"ACTIVE","controls":["sc-20"],"description":"Every key-signing key on a signed zone is ACTIVE, so the signatures are being produced by a live key rather than by one left INACTIVE or in ACTION_NEEDED."}
- {"field":"public-zone-dnssec.KeySigningKeys[].DSRecord","op":"exists","controls":["sc-20"],"description":"Every signed zone emits a delegation signer record — the means by which a parent indicates the security status of this zone and a resolver verifies the chain of trust."}

## GovCloud

Route 53 public and private DNS are available in both GovCloud (US) Regions and DNSSEC signing is supported, with two placement constraints AWS documents: the customer managed key used for signing must be in GovCloud (US-West), and the Route 53 control plane for GovCloud is in GovCloud (US-West). Zone ARNs use partition arn:aws-us-gov. route53domains is a commercial-partition registrar service, so the third command applies only where the domain is registered with Route 53 Domains.

## Notes

Private hosted zones cannot be DNSSEC-signed, which is why the first command narrows to Config.PrivateZone==false before the per-zone loop; asserting SIGNING over every hosted zone would fail on private zones for a reason that is not a finding. Drive the loop from list-hosted-zones rather than from whatever get-dnssec happens to return, so a zone that was never configured is a visible failure instead of an absent row.

SC-20's second limb — the means to indicate the security status of child zones and enable verification of a chain of trust — is carried by KeySigningKeys[].DSRecord, which get-dnssec returns and the assertions cover. Whether that DS record has actually been published by the parent is a fact about the registrar, not about the zone: where the domain is registered with Route 53 Domains, get-domain-detail's DnssecKeys evidences it directly, and where it is registered elsewhere the registrar's own DS confirmation is the artifact to attach. No assertion is written against the third command for that reason — it is decisive for some tenants and inapplicable to others, and an assertion that silently does not apply is worse than a named gap.

ACTION_NEEDED on either the zone status or a KSK is an outage risk, not a paperwork state; AWS recommends a CloudWatch alarm on DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction, and a collector that only samples weekly should not be the first thing to notice it. list-hosted-zones returning no public zones passes all three assertions vacuously — a human confirms this account is the authoritative DNS for the offering's names, and confirms registrar-side DS publication where the registrar is not Route 53 Domains. Partial for the second limb of SC-20.

## References

- {"title":"AWS CLI: route53 get-dnssec (Status.ServeSignature and KeySigningKeys[].Status value sets, DSRecord)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53/get-dnssec.html"}
- {"title":"Configuring DNSSEC signing in Amazon Route 53 (KSK is an asymmetric KMS key you own; parent zone must support DS records; alarm on DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction)","url":"https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html"}
- {"title":"AWS CLI: route53domains get-domain-detail (DnssecKeys — the DS information passed to the registry to establish the chain of trust)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53domains/get-domain-detail.html"}
- {"title":"Amazon Route 53 in AWS GovCloud (US) — DNSSEC signing KMS key must be in GovCloud (US-West); control plane is in GovCloud (US-West)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html"}