DS record lookup
See whether a domain's parent vouches for its DNSSEC keys by publishing a DS record.
What a DS record does
A DS (delegation signer) record connects a domain's DNSSEC keys to its parent, and without it DNSSEC does not protect the domain. DNSSEC adds digital signatures to DNS answers. For a resolver to trust a signed zone, it needs a way to know that the zone's public key is the real one, and the DS record is that link. It lives in the parent zone (for example.com, the .com zone) and holds a digest, a short fingerprint, of the child zone's key-signing key. If it matches a key the child publishes, trust continues from the root down to your domain.
So a DS lookup answers one question: has this domain's registrar told the registry to vouch for its DNSSEC keys? No DS record means the domain is unsigned as far as validating resolvers are concerned.
How to check DNSSEC with a DS lookup
- Look up the domainThe DS query goes to the parent's servers, not the domain's own, which is why it can disagree with what you see at your DNS host. Keep the resolver on a public one, because the domain's own nameservers do not hold its DS.
- Compare it with the keysLook up the DNSKEY records. A valid setup has a DS whose key tag and digest match one of the zone's key-signing keys.
- Cross-check at the registryThe WHOIS lookup shows the DS data the registry holds and whether the delegation is marked as signed.
Reading a DS record
A DS record has four fields, for example 12345 13 2 49fd46e6c4b4...:
| Field | Example | Meaning |
|---|---|---|
| Key tag | 12345 | A short number that identifies the DNSKEY it refers to. It is not unique, but it is a quick match. |
| Algorithm | 13 | The signing algorithm of the key. 8 is RSA/SHA-256, 13 is ECDSA P-256, 14 is ECDSA P-384, 15 is Ed25519 and 16 is Ed448. |
| Digest type | 2 | The hash used. 2 is SHA-256 and 4 is SHA-384. Type 1 (SHA-1) is deprecated. |
| Digest | 49fd46e6c4b4... | The hash of the key and the zone name. |
- No DS, but the zone has DNSKEYs. The zone is signed but not anchored, so validators treat it as unsigned. It does no harm, and gives no protection either.
- A DS with no matching DNSKEY. Validating resolvers return SERVFAIL for the whole domain. This is the most serious DNSSEC failure.
- More than one DS. Normal during a key rollover, or when two providers sign the zone together.
Common problems
- The domain is unreachable for some users only. Resolvers that validate DNSSEC, which includes many large public ones and ISPs, reject the domain. Others do not. A stale DS after a change of DNS provider is the usual cause.
- You are moving DNS provider. Remove the old DS at your registrar and wait for its TTL to pass before you change nameservers. Add the new provider's DS once the new zone is signed. Otherwise the DS points to keys the new host does not have. A multi-signer setup, where both providers sign the zone, avoids the gap.
- Wrong digest type or algorithm. Give the registrar exactly the values your DNS host shows, including the algorithm and the digest type.
- Your registrar has no DS field. Some registrars cannot publish DS records for every extension. Transfer the domain, or use your provider's automation if it offers one.
- Automation. DNS hosts can publish CDS and CDNSKEY records, which registries read to update the DS themselves (RFC 7344, RFC 8078).
How the lookup works and the standards
LookupOwl asks for type DS (code 43) with DNSSEC enabled. The parent zone's servers answer DS questions, so resolvers send them there. DS is defined in RFC 4034, SHA-256 digests in RFC 4509, ECDSA in RFC 6605, and Ed25519 and Ed448 in RFC 8080. Algorithm guidance is in RFC 8624, and the whole protocol family in RFC 4033, RFC 4034 and RFC 4035.
dig +short DS example.com
dig example.com DNSKEY +multi
# Compute the DS from a published key to compare
dig example.com DNSKEY | dnssec-dsfromkey -2 -f - example.comQuestions people ask
What is a DS record?
A DS record is a record in the parent zone that holds a hash of the child zone's key-signing key. It connects the child to the parent in the DNSSEC chain of trust. Without it, validating resolvers have no reason to trust the keys your zone publishes, so they treat the zone as unsigned.
How do I know if a domain uses DNSSEC?
Look up its DS record. If one exists at the parent and a key in the zone's DNSKEY set matches it, the domain is signed and validating resolvers can check it. No DS record means DNSSEC is not protecting the domain. Many domains are in that group, so a missing DS is common, not a fault.
Where do I add a DS record?
Add it at your registrar, not at your DNS host. Your DNS host shows you the key tag, algorithm, digest type and digest. You copy those four values into the DNSSEC settings of your registrar, which passes them to the registry. Some DNS hosts can do this for you if they also act as your registrar.
Why did my domain stop resolving after I enabled DNSSEC?
The DS at the registry probably does not match the keys your DNS host signs with. Validating resolvers then refuse every answer for your domain. Fix the DS so it matches, or remove it and wait for caches to expire. Check the key tag and digest against the DNSKEY lookup.
How do I remove a DS record safely?
Remove the DS record at your registrar first, then wait at least as long as the DS record's TTL before you turn signing off at your DNS host. If you disable signing first, validating resolvers still expect signatures and will fail the domain. Always remove the DS before you delete the keys.
What is the difference between DS and DNSKEY?
DNSKEY is the public key published in your own zone. DS is a fingerprint of that key, published by the parent zone. Because the parent signs its DS record, resolvers can trust the fingerprint, and then use it to trust your key. A working setup has both, and they match.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dns_lookup. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dns-lookup?q=cloudflare.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp