# CDS record

A CDS (child DS) record is your zone's own copy of the DS record it wants the parent to publish. Registries and registrars that support it check it and update the DS for you, so key rollovers and turning DNSSEC on or off need no manual step. A CDS of 0 0 0 00 asks for DNSSEC to be turned off.

- Record type: CDS
- Type number: 59
- Used for: DNSSEC
- How common: Specialist
- Defined in: RFC 7344, RFC 8078

## Format

```
@ <ttl> IN CDS <key tag> <algorithm> <digest type> <digest>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Fields | Exactly as DS. | See [DS](https://lemon.domains/dns-records/ds). |

## Examples

### The DS you want

```
@ 3600 IN CDS 2371 13 2 1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5
```

Supporting parents (such as .ch, .cz, .se and several registrars) copy it into the DS.

### Turn DNSSEC off

```
@ 3600 IN CDS 0 0 0 00
```

Asks the parent to remove the DS.

## TTL

3600.

## Common mistakes

- Expecting every registry to read it. Many still need the DS entered at the registrar.

## At your DNS host

- Cloudflare publishes CDS and CDNSKEY on signed zones automatically.

## Questions

### Does .com read CDS records?

Not directly. Some registrars scan CDS for .com domains and update the DS for you; others need it entered by hand.

## Related

- [CDNSKEY record](https://lemon.domains/dns-records/cdnskey.md)
- [DS record](https://lemon.domains/dns-records/ds.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/cds