A DS (Delegation Signer) record is a DNSSEC record published in the parent zone that holds a hash of your domain's DNSKEY. It links the parent to your zone so resolvers can verify that your DNSSEC signatures are authentic.

How do I use this tool?

Enter a domain name and the tool queries its DS record server-side, then shows any DS entries returned by the parent zone. Each result lists the key tag, algorithm number, digest type and the digest itself, so you can confirm DNSSEC is enabled at the registry.

Why does the DS record matter?

The DS record is what activates the DNSSEC chain of trust between your registrar/registry and your DNS zone. Without a matching DS record at the parent, resolvers treat your domain as unsigned and cannot detect forged or tampered DNS answers.

How do I read the DS record fields?

A DS record has four fields: the key tag (identifies the matching DNSKEY), the algorithm (for example 13 for ECDSA), the digest type (1=SHA-1, 2=SHA-256, 4=SHA-384) and the digest (the actual hash). The key tag and algorithm must match your published DNSKEY for validation to succeed.

Why is my DS record missing or causing failures?

An empty result usually means DNSSEC is not enabled or the DS was never submitted to your registrar, which is normal for unsigned domains. If a DS is present but points to an old or wrong DNSKEY, validation breaks (SERVFAIL) and you must update or remove the stale DS at your registrar.

DS Record Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

The DS (Delegation Signer) record lives in the parent zone (e.g. .com) and contains a hash of your zone's Key Signing Key. It is what links your DNSSEC keys into the global chain of trust, and it is managed through your registrar.

How to read your result

If your zone is signed, a DS should exist and its key tag should correspond to your current KSK. A DS with no matching DNSKEY — or DNSKEY with no DS — are the two broken half-states worth acting on.

Common problems and how to fix them

Stale DS record after switching DNS providers

How it shows up: The domain resolves for some users and SERVFAILs for others; the failures started right after a nameserver change.

How to fix it: Log in at the registrar and delete the old DS record (or replace it with one matching the new provider's keys, if the new provider signs the zone). This is the single most common DNSSEC outage.

Zone is signed but no DS was ever published

How it shows up: DNSSEC provides no protection — validating resolvers treat the zone as unsigned, though nothing is broken.

How to fix it: Get the DS data (key tag, algorithm, digest) from your DNS provider and enter it at your registrar. Many registrar panels have a dedicated DNSSEC section for this.

DS uses a deprecated digest (SHA-1)

How it shows up: Some validators warn or refuse; security audits flag it.

How to fix it: Publish a new DS using digest type 2 (SHA-256) and remove the SHA-1 one.

Frequently asked questions

What is a DS record?: A DS (Delegation Signer) record is a DNSSEC record published in the parent zone that holds a hash of your domain's DNSKEY. It links the parent to your zone so resolvers can verify that your DNSSEC signatures are authentic.
How do I use this tool?: Enter a domain name and the tool queries its DS record server-side, then shows any DS entries returned by the parent zone. Each result lists the key tag, algorithm number, digest type and the digest itself, so you can confirm DNSSEC is enabled at the registry.
Why does the DS record matter?: The DS record is what activates the DNSSEC chain of trust between your registrar/registry and your DNS zone. Without a matching DS record at the parent, resolvers treat your domain as unsigned and cannot detect forged or tampered DNS answers.
How do I read the DS record fields?: A DS record has four fields: the key tag (identifies the matching DNSKEY), the algorithm (for example 13 for ECDSA), the digest type (1=SHA-1, 2=SHA-256, 4=SHA-384) and the digest (the actual hash). The key tag and algorithm must match your published DNSKEY for validation to succeed.
Why is my DS record missing or causing failures?: An empty result usually means DNSSEC is not enabled or the DS was never submitted to your registrar, which is normal for unsigned domains. If a DS is present but points to an old or wrong DNSKEY, validation breaks (SERVFAIL) and you must update or remove the stale DS at your registrar.

Why it matters

A zone can be perfectly signed and still gain nothing from DNSSEC if no DS record exists in the parent — resolvers simply treat it as unsigned. The reverse is worse: a stale DS record pointing at keys the zone no longer uses makes validating resolvers reject the domain entirely. DS records are managed through the registrar, not the DNS host, which is why they are so often forgotten during migrations.

Examples

A DS record contains a key tag, algorithm number, digest type and the digest itself — e.g. "2371 13 2 <sha-256 hash>".
When switching DNS providers on a DNSSEC-enabled domain, remove or update the DS record at the registrar before the switch, or the domain can go dark for validating resolvers.
Digest type 2 (SHA-256) is the current standard; type 1 (SHA-1) is deprecated.