DS Lookup

Query DS records to verify DNSSEC delegation and chain of trust

DS (Delegation Signer) records establish a chain of trust in DNSSEC by containing hashes of DNSKEY records from child zones. They are stored in the parent zone.

Domain Lookup

Enter a domain name to query its DS records

Ready to Lookup DS Records

Enter a domain name above to query its DS records and verify DNSSEC delegation.

What you'll get:

Delegation Signer record details
Chain of trust validation
Algorithm and digest type analysis
Security recommendations

What are DS Records?

DS (Delegation Signer) records are DNS records that establish a chain of trust for DNSSEC (DNS Security Extensions). They are published in the parent zone and contain a cryptographic hash of a DNSKEY record from the child zone, enabling secure delegation and validation of DNS responses.

Key Components:

Key Tag: A short numeric identifier for the DNSKEY record
Algorithm: The cryptographic algorithm used (e.g., RSA/SHA-256, ECDSA)
Digest Type: The hash algorithm used to create the digest (SHA-1, SHA-256, etc.)
Digest: The cryptographic hash of the DNSKEY record