DS Lookup
Query DS records to verify DNSSEC delegation and chain of trust
Ready to Lookup DS Records
Enter a domain name above to query its DS records and verify DNSSEC delegation.
What you'll get:
- Delegation Signer record details
- Chain of trust validation
- Algorithm and digest type analysis
- Security recommendations
This page provides original, human-reviewed information about DS record lookups, explaining delegation signer digests, how registrars publish DS records, and diagnosing DNSSEC validation failures.
DS (Delegation Signer) records are DNS records that establish a chain of trust for DNSSEC (DNS Security Extensions).
Key Components:
- Key Tag:A short numeric identifier for the DNSKEY record
- Algorithm:The cryptographic algorithm used (e.g., RSA/SHA-256, ECDSA)
- Digest Type:The hash algorithm used to create the digest (SHA-1, SHA-256, etc.)
- Digest:The cryptographic hash of the DNSKEY record
How DS Records Work:
- The child zone generates DNSKEY records and signs its zone data
- A DS record is created containing a hash of the child's DNSKEY
- The DS record is published in the parent zone and signed by the parent
- Resolvers can verify the chain of trust from parent to child
- This enables end-to-end validation of DNS responses
Prerequisites:
- Your domain must be DNSSEC-enabled
- You need access to your domain registrar's DNS management
- DNSKEY records must be properly configured in your zone
Step-by-Step Process:
- Generate DNSKEY records for your zone
- Create DS records from your DNSKEY records using tools like dnssec-dsfromkey
- Submit the DS records to your domain registrar
- Wait for propagation (usually 24-48 hours)
- Verify the chain of trust using DNSSEC validation tools
Example DS Record:
No DS Records Found
The domain has no DS records, meaning DNSSEC is not enabled or not properly configured.
Solution: Enable DNSSEC and publish DS records with your registrar.
DS/DNSKEY Mismatch
The DS record doesn't match any DNSKEY in the child zone.
Solution: Regenerate DS records from current DNSKEY records.
Weak Digest Algorithm
Using SHA-1 digest type which is considered weak.
Solution: Upgrade to SHA-256 or SHA-384 digest types.
Propagation Delays
DS records may take time to propagate across all DNS servers.
Solution: Wait 24-48 hours and check multiple DNS resolvers.
Validation Tools:
- dig +dnssec example.com DS
- dnssec-verify online tools
- Verisign DNSSEC Debugger
- DNSViz visualization tool
Q: What happens if I have incorrect DS records?
Incorrect DS records will cause DNSSEC validation failures, making your domain unreachablefor users with DNSSEC-validating resolvers. Always verify DS records before publishing.
Q: Can I have multiple DS records?
Yes, having multiple DS records is recommended for redundancy. You can have DS recordsfor different DNSKEY records or different digest algorithms.
Q: How often should I update DS records?
DS records should be updated during key rollovers, typically every 1-2 years, or whenupgrading cryptographic algorithms. Plan key rollovers carefully to avoid downtime.
Q: What's the difference between KSK and ZSK?
KSK (Key Signing Key) is used to sign DNSKEY records and is referenced by DS records.ZSK (Zone Signing Key) signs the zone data. This separation allows for more flexible key management.
Q: Why should I avoid SHA-1 digest type?
SHA-1 is cryptographically weak and deprecated. Modern implementations should use SHA-256or SHA-384 for better security. Many validators may reject SHA-1 in the future.
Q: How do I test my DNSSEC configuration?
Use tools like dig +dnssec, online DNSSEC validators, or DNSViz. Test from multiplelocations and resolvers to ensure consistent validation results.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.