yeah as I said registrar and registry have to play fine with DNSSec but after that the DNSServer has the role of doing it.