AWS requires the DNSSEC KMS key in the US East (N. Virginia) region, with an asymmetric ECC_NIST_P256 key specification and signing/verification usage. Keep it enabled. Its policy must give the Route 53 DNSSEC service the required key access, and the integration identity needs the Route 53 actions required for the planned operation.

Use AWS's current policy examples for your own account and hosted zone. Do not paste a policy containing someone else's account or resource ARN. Key policy and the API user's IAM policy address different parts of the authorisation path.

1. Verify that the domain uses the intended public Route 53 hosted zone and that its ordinary DNS records are correct.
2. Edit the Domain Nexus AWS Route53 connection.
3. Enter the prepared key's complete ARN in DNSSEC KMS Key ARN and review DNSSEC KSK Name.
4. Save and request DNSSEC enablement for an authorised test or planned production zone.
5. Inspect the completed operation and provider signing status. Obtain the actual DS values for the zone's active key.
6. Publish the corresponding DS through the parent registrar and verify a validating DNS query after the change.

Monitor the hosted zone's signing-key health and KMS access. Removing a key permission or disabling the KMS key can break signing even when no ordinary DNS record changed. AWS provides DNSSEC health signals that should be included in the operator's monitoring.

Complete the DNSSEC migration and parent DS transition first. A parent DS still pointing at the old signing arrangement can cause validation failures when the key or DNS service disappears. Keep the old service available for the reviewed transition period and verify the final chain before retiring its resources.

• Connect Route 53 and separate DNS changes from optional KMS signing access
• Operate DNSSEC from zone signing through parent DS verification
• Move managed zones to another DNS provider with a verified rollback point
• Connect deSEC while preserving its DNSSEC and delegation requirements

• AWS: DNSSEC customer managed key requirements
• AWS: Configuring DNSSEC signing