diff --git a/lib/serializers/registrant_api/domain.rb b/lib/serializers/registrant_api/domain.rb
index 0814ae5f2..9559a70ad 100644
--- a/lib/serializers/registrant_api/domain.rb
+++ b/lib/serializers/registrant_api/domain.rb
@@ -42,11 +42,23 @@ module Serializers
           locked_by_registrant_at: domain.locked_by_registrant_at,
           status_notes: domain.status_notes,
           nameservers: nameservers,
+          dnssec_keys: dnssec_keys,
+          dnssec_changed_at: dnssec_updated_at
         }
       end
 
       private
 
+      def dnssec_keys
+        domain.dnskeys.map do |key|
+          "#{key.flags} #{key.protocol} #{key.alg} #{key.public_key}"
+        end
+      end
+
+      def dnssec_updated_at
+        domain.dnskeys.order(updated_at: :desc).select(:updated_at).first
+      end
+
       def contacts(type)
         contact_pool = begin
                          if type == :tech
diff --git a/test/integration/api/registrant/registrant_api_domains_test.rb b/test/integration/api/registrant/registrant_api_domains_test.rb
index 467204636..22516fecc 100644
--- a/test/integration/api/registrant/registrant_api_domains_test.rb
+++ b/test/integration/api/registrant/registrant_api_domains_test.rb
@@ -29,7 +29,11 @@ class RegistrantApiDomainsTest < ApplicationIntegrationTest
                    email: 'john@inbox.test'}],
                  domain[:tech_contacts])
     assert_equal({ name: 'Good Names', website: nil }, domain[:registrar])
+
     assert_equal([], domain[:nameservers])
+    assert_equal([], domain[:dnssec_keys])
+    assert(domain.has_key?(:dnssec_changed_at))
+
     assert(domain.has_key?(:locked_by_registrant_at))
   end