DS Record Look Up

The DS (Delegation Signer) look up returns the record the parent zone publishes for a signed domain: a hash of the domain's Key Signing Key, which is what actually connects the zone to the global DNSSEC chain of trust.

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

How to use this tool

Pick a lookup type from the dropdown, or type a shortcut straight into the field — e.g. mx:example.com, all:example.com, spf:example.com, whois:example.com — and press Enter.
Enter a domain name (e.g. example.com), or an IP address for PTR and blacklist look ups.
Toggle "Also look up blacklist status" above to include a DNSBL look up alongside your search.
Your last 20 look ups are saved in the History panel so you can revisit them anytime.

Why it matters

A zone can be perfectly signed and still gain nothing from DNSSEC if no DS record exists in the parent — resolvers simply treat it as unsigned. The reverse is worse: a stale DS record pointing at keys the zone no longer uses makes validating resolvers reject the domain entirely. DS records are managed through the registrar, not the DNS host, which is why they are so often forgotten during migrations.

Examples

A DS record contains a key tag, algorithm number, digest type and the digest itself — e.g. "2371 13 2 <sha-256 hash>".
When switching DNS providers on a DNSSEC-enabled domain, remove or update the DS record at the registrar before the switch, or the domain can go dark for validating resolvers.
Digest type 2 (SHA-256) is the current standard; type 1 (SHA-1) is deprecated.