DS record
A DS (delegation signer) record lives in the parent zone, such as .com, and holds a fingerprint of your zone's key-signing key. It links your domain into the DNSSEC chain of trust. You set it at your registrar after turning DNSSEC on at your DNS host. A wrong or stale DS makes the whole domain fail to resolve for validating resolvers.
| Record type | DS |
|---|---|
| Type number | 43 |
| Used for | DNSSEC |
| How common | Common |
| Defined in | RFC 4034, RFC 4509 |
Format
<domain> <ttl> IN DS <key tag> <algorithm> <digest type> <digest>
| Field | What it means | Accepted values |
|---|---|---|
| Key tag | A short number identifying the key. | 0 to 65535; from your DNS host. |
| Algorithm | The key's algorithm, same number as in DNSKEY. | 13, 8, 15 and so on. |
| Digest type | The hash used. | 2 (SHA-256) is standard. 1 (SHA-1) is retired. |
| Digest | The hash of your DNSKEY, in hex. | 64 hex characters for SHA-256. |
Check a DS record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid DS record.
| Part | What it means |
|---|---|
| Nameexample.com. | A full name: the final dot means nothing is added to it. |
| TTL86400 | Resolvers may keep this answer for 1 day before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeDS | DNSSEC: fingerprint of a child zone's key. |
| Key tag2371 | A short number identifying the child zone's key-signing DNSKEY. |
| Algorithm13 | 13 is ECDSA P-256 with SHA-256. The recommended choice: small keys and signatures, supported everywhere. |
| Digest type2 | 2: SHA-256. The standard choice. |
| Digest1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5 | The hash of the child's DNSKEY. If it doesn't match a key the child publishes, the whole domain fails to resolve for validating resolvers. |
Examples
A typical DS
example.com. 86400 IN DS 2371 13 2 1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5
Copy these four values from your DNS host into the registrar's DNSSEC form.
DNSSEC in one paragraph
DNSSEC signs a zone's records so resolvers can prove an answer really came from the domain's owner and wasn't changed. Your DNS host signs the zone and publishes the keys (DNSKEY); the parent zone, such as .com, publishes a fingerprint of your key (DS), which you set at your registrar. That links your zone into a chain of trust that starts at the root.
Moving a signed domain
- Easiest: remove the DS at the registrar, wait two days (the DS TTL), move the nameservers, then turn DNSSEC on at the new host and add its DS.
- Without a gap: add the new host's DNSKEY at the old host and the new DS at the registrar first. Only possible if both hosts allow it.
See it on a real domain
TTL
Set by the parent zone, often 86400 or 3600. How TTL works
Common mistakes
- Leaving an old DS at the registrar after changing DNS hosts. The domain goes dark for validating resolvers, with SERVFAIL errors.
- Adding a DS before the DNS host has started signing.
- Typing the digest by hand with a typo. Paste it.
At your DNS host
- Registrars have a DNSSEC or DS records section; enter key tag, algorithm, digest type and digest.
- Cloudflare Registrar and some others add the DS automatically when the zone is on the same company's DNS.
Questions
Where do I add a DS record?
At your registrar, not at your DNS host. The DS is published by the parent zone (.com, .org and so on), and only your registrar can send it there.
My domain stopped resolving after changing DNS host. Why?
Most likely an old DS record is still at the registrar. Validating resolvers can't verify the new host's answers and return SERVFAIL. Remove the DS at the registrar.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free