A method and system for managing IPsec Security Associations in a Security Association Database (SADB) in an IP network is described. At a key management application, a domain extension header is inserted into a PF_KEY message containing instructions to a key engine unit. The domain extension header identifies a domain within the Security Association Database. The PF_KEY message is sent to the key engine unit, which carries out the instructions only for Security Associations in the domain of the Security Association Database indicated by the domain extension header.