A DS (Delegation Signer) record is published in the parent zone, for example in .com for example.com. It contains the key tag, algorithm, digest type and a digest of the child zone's key-signing key (a DNSKEY record). Validating resolvers use it to confirm the child's keys are genuine.
Why it matters
The DS record is the link in the DNSSEC chain of trust between your zone and the TLD. You add it through your registrar. If it is missing, DNSSEC is not active for the domain. If it points to a key that no longer exists, validating resolvers return SERVFAIL and the whole domain can become unreachable for users behind them. This most often happens after changing DNS providers.
Example
$ dig example.com DS +short
12345 13 2 49FD46E6C4B45C55D4AC...The fields are key tag 12345, algorithm 13 (ECDSA P-256), digest type 2 (SHA-256) and the digest itself.
Common mistakes
- Moving DNS hosting while DNSSEC is on without removing or updating the DS record.
- Pasting the wrong key tag or digest type from the provider.
- Removing the DNSKEY but not the DS record, or vice versa.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.