Has anyone actually gotten Hetzner to remove a DS record *during* an outgoing transfer, or do you always have to do the disable-and-wait dance first
I have a client sitting in limbo right now because they initiated the transfer before I could warn them about the DS record and now we're just... waiting for someone to answer a ticket
Has anyone actually gotten Hetzner to auto-remove a DS during transfer? I went through this last year and their support basically said "we don't touch DNSSEC records for liability reasons." Ended up having to file a ticket and wait two days anyway.
Yeah this is basically the whole industry. "Automatic" until it isn't.
Did you ever solve this or just eat the wait?
Member
Ah 21 days lah this thread xixixi
You are right lah but I am want to add one thing
I am finally solve my .dev transfer last month after I am open ticket and ask human remove DS record manually
Their "automatic" system it am send email say "transfer complete" but the DS it am still there xixixi I am must ask again
So the workaround number 1 from marcus_qc it am the only way lah remove first before you start
I am forget again yesterday for my friend domain xixixi
Member OP
Been quiet here for a bit but wanted to close the loop on my own mess.
Yeah that's basically the full picture. I ended up having to open a ticket with the old registrar anyway because their "disable DNSSEC" button threw an error. Took six days total.
The real kicker is I now have a calendar reminder called "remove DS before transfer" because apparently we can't trust any part of this pipeline.
Did anyone actually get Hetzner's disable button to work properly, or is it just cosmetic
I transferred a .dev out to Vultr last month and had to open a ticket for them to manually drop the DS, the UI toggle did nothing for 48 hours
Honestly the whole industry pretends DNSSEC is "set and forget" until you try to move anything, then it's suddenly your problem to become an expert in 48 hours before the transfer token expires
Has anyone tried just... not using DNSSEC for new domains until the registrars figure this out? I know that's heresy but the breakage-to-value ratio feels off lately
Member
This is exactly why I moved my own domains to HostHatch last year. Their outgoing transfer flow actually prompts you about DS records before you start, which is such a basic thing.
Did anyone ever find out if Hetzner fixed this? 62 days is a long time but I just ran into the same mess with a client who used them.
82 days and Hetzner still hasn't fixed this flow, I'm guessing
The real kicker is you can't even remove the DS *during* the transfer, it's locked. So your "automatic" transfer is just dead air until the old registrar feels like answering a ticket
I moved a client off them to Vultr last quarter, same DNSSEC dance, Vultr at least warns you upfront with a big red banner. Small thing but saves hours
Has anyone actually seen a registrar handle this gracefully end to end
106 days late but did anyone ever get Hetzner to actually auto-remove the DS on outgoing transfer? I just had to open a ticket and wait 48 hours. Their panel still says "automatic" right there in the UI.
Yeah that tracks. The extra waiting is the best part.
