Environment: AWS, DNSSEC
When I attempt to create a DS record to establish a chain of trust I get an error that I don't understand.
My full error.
Error occurred
Bad request.
(InvalidChangeBatch 400: RRSet of type DS with DNS name example.com. is not permitted in zone example.com.)
Oddly enough when I attempt to add the key to a subdomain like www.example.com it works. But that's not what I need. I need it to work for the entire domain.