HTTPfy

DS record

A DS (delegation signer) record sits in the parent zone and holds a hash of the child zone's key-signing key. It is what makes DNSSEC a chain rather than a set of isolated signatures.

type code 43 RFC 4034RFC 4509RFC 8624

Live DS records from real domains

Checked at via public DNS
cloudflare.comDS
cloudflare.com. 86400 IN DS 2371 13 2 32996839a6d808afe3eb4a795a0e6a7a39a76fc52ff228b22b76f6d63826f2b9
  ; key tag 2371, ECDSAP256SHA256, SHA-256 digest of the child KSK
isc.orgDS
isc.org. 3600 IN DS 7250 13 2 a30b3f78b6dde9a4a9a2ad0c805518b4f49ec62e7d3f4531d33de697cda01cb2
  ; key tag 7250, ECDSAP256SHA256, SHA-256 digest of the child KSK
comDS
com. 81761 IN DS 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a
  ; key tag 19718, ECDSAP256SHA256, SHA-256 digest of the child KSK
paypal.comDS
paypal.com. 86400 IN DS 31311 13 2 cc1996404e8cbe2e1b4aedcf8918d5fa215317f3d7ebf8d5c5581df98ab12dfd
  ; key tag 31311, ECDSAP256SHA256, SHA-256 digest of the child KSK
paypal.com. 86400 IN DS 7037 13 2 9778f2ff96889ebed549795deaa40a6113f1899af7ca8dd7947fddfeca9a190b
  ; key tag 7037, ECDSAP256SHA256, SHA-256 digest of the child KSK
DNSSEC Inspector for cloudflare.com →

What the DS record does

The root zone holds DS records for com; the com zone holds DS records for example.com; and so on. A validating resolver checks that the hash in the DS matches one of the child's DNSKEY records, and that DNSKEY signs the rest of the child zone. You publish the DS through your registrar (or automatically with CDS/CDNSKEY, RFC 7344/8078); it never appears in your own zone.

If a DS exists but the child zone is unsigned, or signed with a different key, validating resolvers (8.8.8.8, 1.1.1.1, 9.9.9.9 and most ISPs) return SERVFAIL and the domain disappears for most users. That is the most common DNSSEC outage, and it usually happens after moving DNS providers.

Zone-file syntax

example.com.  86400  IN  DS  2371 13 2 32996839a6d808afe3eb4a795a0e6a7a39a76fc52ff228b22b76f6d63826f2b9
; key tag, algorithm, digest type, digest

Wire format: RDATA is a 16-bit key tag, an 8-bit algorithm, an 8-bit digest type and the digest bytes.

Fields

FieldMeaning
Key tagShort identifier of the DNSKEY it refers to (not unique, just a hint).
AlgorithmDNSKEY algorithm: 8 RSASHA256, 13 ECDSAP256SHA256 (most common today), 14 ECDSAP384SHA384, 15 Ed25519.
Digest type2 SHA-256 (recommended), 4 SHA-384. Type 1 (SHA-1) should not be published any more: RFC 8624 marks it MUST NOT for new delegations.
DigestHex hash of the owner name plus the DNSKEY RDATA.

Common mistakes

  • Changing DNS provider without removing the old DS first (or pre-publishing the new provider's key). Validation breaks.
  • Uploading the DS of the zone-signing key (flags 256) instead of the key-signing key (flags 257).
  • Leaving a SHA-1 digest-type DS as the only record.

Specification

  • RFC 4034: Resource Records for the DNS Security Extensions
  • RFC 4509: Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records
  • RFC 8624: Algorithm Implementation Requirements and Usage Guidance for DNSSEC

Related record types

  • DNSKEY: the public keys that sign a zone
  • RRSIG: the DNSSEC signature over an RRset
  • NSEC: authenticated denial of existence
  • NS: the nameservers authoritative for a zone

All DNS record types