When we host LemonadeLXP for you, we typically host it on a subdomain of your zone. For example, if your domain is acme.com, we'd typically host LemonadeLXP on something like learn.acme.com.

If you enable DNSSEC at acme.com without getting DS keys for learn.acme.com, the result will be that your DNS for LemonadeLXP will go down. This will break everything from site resolution, to the issuance of edge SSL certificates.

First, contact your CX representative to obtain DS keys for your LemonadeLXP subdomain. You will need to install these DS keys at the parent zone before you enable DNSSEC.

You can enable DNSSEC only after these DS keys resolve.

As heads up, if you have other services on other provider/vendor subdomains, you will need to repeat these steps with them as well before enabling DNSSEC on the root domain.