CDS record
A CDS (child DS) record is your zone's own copy of the DS record it wants the parent to publish. Registries and registrars that support it check it and update the DS for you, so key rollovers and turning DNSSEC on or off need no manual step. A CDS of 0 0 0 00 asks for DNSSEC to be turned off.
| Record type | CDS |
|---|---|
| Type number | 59 |
| Used for | DNSSEC |
| How common | Specialist |
| Defined in | RFC 7344, RFC 8078 |
Format
@ <ttl> IN CDS <key tag> <algorithm> <digest type> <digest>
| Field | What it means | Accepted values |
|---|---|---|
| Fields | Exactly as DS. | See DS. |
Check a CDS record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid CDS record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeCDS | Child's copy of DS, for automatic updates. |
| Key tag2371 | A short number identifying the child zone's key-signing DNSKEY. |
| Algorithm13 | 13 is ECDSA P-256 with SHA-256. The recommended choice: small keys and signatures, supported everywhere. |
| Digest type2 | 2: SHA-256. The standard choice. |
| Digest1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5 | The hash of the key the parent should publish as DS. |
Examples
The DS you want
@ 3600 IN CDS 2371 13 2 1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5
Supporting parents (such as .ch, .cz, .se and several registrars) copy it into the DS.
Turn DNSSEC off
@ 3600 IN CDS 0 0 0 00
Asks the parent to remove the DS.
See it on a real domain
TTL
3600. How TTL works
Common mistakes
- Expecting every registry to read it. Many still need the DS entered at the registrar.
At your DNS host
- Cloudflare publishes CDS and CDNSKEY on signed zones automatically.
Questions
Does .com read CDS records?
Not directly. Some registrars scan CDS for .com domains and update the DS for you; others need it entered by hand.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free