# DS record

A DS (delegation signer) record lives in the parent zone, such as .com, and holds a fingerprint of your zone's key-signing key. It links your domain into the DNSSEC chain of trust. You set it at your registrar after turning DNSSEC on at your DNS host. A wrong or stale DS makes the whole domain fail to resolve for validating resolvers.

- Record type: DS
- Type number: 43
- Used for: DNSSEC
- How common: Common
- Defined in: RFC 4034, RFC 4509

## Format

```
<domain> <ttl> IN DS <key tag> <algorithm> <digest type> <digest>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Key tag | A short number identifying the key. | 0 to 65535; from your DNS host. |
| Algorithm | The key's algorithm, same number as in DNSKEY. | 13, 8, 15 and so on. |
| Digest type | The hash used. | 2 (SHA-256) is standard. 1 (SHA-1) is retired. |
| Digest | The hash of your DNSKEY, in hex. | 64 hex characters for SHA-256. |

## Examples

### A typical DS

```
example.com. 86400 IN DS 2371 13 2 1F987CC6583E92DF0890718C42E4C2C4F3F4D1BFA1B0F4C2F6D1C1E3A7A4B3C5
```

Copy these four values from your DNS host into the registrar's DNSSEC form.

## DNSSEC in one paragraph

DNSSEC signs a zone's records so resolvers can prove an answer really came from the domain's owner and wasn't changed. Your DNS host signs the zone and publishes the keys (DNSKEY); the parent zone, such as .com, publishes a fingerprint of your key (DS), which you set at your registrar. That links your zone into a chain of trust that starts at the root.

## Moving a signed domain

- Easiest: remove the DS at the registrar, wait two days (the DS TTL), move the nameservers, then turn DNSSEC on at the new host and add its DS.
- Without a gap: add the new host's DNSKEY at the old host and the new DS at the registrar first. Only possible if both hosts allow it.

## TTL

Set by the parent zone, often 86400 or 3600.

## Common mistakes

- Leaving an old DS at the registrar after changing DNS hosts. The domain goes dark for validating resolvers, with SERVFAIL errors.
- Adding a DS before the DNS host has started signing.
- Typing the digest by hand with a typo. Paste it.

## At your DNS host

- Registrars have a DNSSEC or DS records section; enter key tag, algorithm, digest type and digest.
- Cloudflare Registrar and some others add the DS automatically when the zone is on the same company's DNS.

## Questions

### Where do I add a DS record?

At your registrar, not at your DNS host. The DS is published by the parent zone (.com, .org and so on), and only your registrar can send it there.

### My domain stopped resolving after changing DNS host. Why?

Most likely an old DS record is still at the registrar. Validating resolvers can't verify the new host's answers and return SERVFAIL. Remove the DS at the registrar.

## Related

- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)
- [CDS record](https://lemon.domains/dns-records/cds.md)
- [CDNSKEY record](https://lemon.domains/dns-records/cdnskey.md)
- [NS record](https://lemon.domains/dns-records/ns.md)
- [RRSIG record](https://lemon.domains/dns-records/rrsig.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/ds