Create an authorised deSEC API token for the intended domains. Review its high-level domain creation and deletion permissions separately from its record-set policies. A token restricted to an existing TXT record may work for certificate validation but cannot manage a whole hosting zone.

Use policies that match the operational scope. A deliberately restricted token should not also receive unnecessary token-management powers. Where you need new zones created automatically, ensure the credential and applicable policies permit both zone creation and the subsequent record changes.

1. Add a Domain Nexus server and choose deSEC (DNSSEC by default).
2. Paste the secret into API token.
3. Leave API URL at the normal service default. A different self-hosted endpoint requires a separately authorised supported configuration.
4. Save, run the check and read an owned zone.
5. Test a temporary TXT update and compare the provider state. Prepare the actual deSEC nameserver delegation in accordance with the service's requirements.
6. Read the zone's DNSSEC information and publish the matching parent DS when establishing the validation chain.

The provider signs its zones by design, and the adapter reports that limitation. If you need an unsigned authoritative backend, plan a provider migration. Remove or update the parent DS in the appropriate order and allow its cached state to expire before relying on a differently signed or unsigned replacement.

Review the provider's service conditions before using it as a passive replica. This adapter does not expose secondary-zone operation. Domain Nexus's multi-server synchronisation does not override a provider's conditions or make a hidden copy an authorised use of the service.

If a request is rejected, distinguish token policies, account limits and DNS validation problems. Keep the current provider records intact while diagnosing access.

• Operate DNSSEC from zone signing through parent DS verification
• Synchronize a DNS package across multiple servers and select its master
• Move managed zones to another DNS provider with a verified rollback point
• Upgrade Domain Nexus while preserving keys, settings and customer data

• deSEC: Token permissions and policies
• deSEC: Domain management