Add and Remove DS Records
Last updated
Table of Contents
To add a DS record for a domain registered with DNSimple, open the domain’s tab, click on the card, and click . We send the record to the registry for you. You only need to do this when another DNS provider signs your zone. If DNSimple signs your zone, we manage the DS record automatically.
DS (Delegation Signer) records are used in DNSSEC to secure your domain. DS records in DNSimple are managed at the domain level: they apply to the registered domain and are published at the registry in the parent zone. Adding DS records for a subdomain delegated with NS records (a zone cut) is not supported, so the chain of trust cannot extend to a delegated subdomain.
Adding a DS record
To add a DS record
-
Use the account switcher at the top of the page to select the appropriate account.
-
From your list, click the domain name to access its management page.
-
Click the tab on the left.
-
Click in the card, at the bottom of the page.
-
On the page, click .
-
Select the , then fill in the DS record in one of two formats, using the values from your DNS provider:
- DS-data: enter the (the number that identifies the DNSKEY record), the (the hash algorithm), and the (the hash of the DNSKEY record, in hexadecimal).
- KEY-data: enter the of your zone’s key-signing key, and leave the other fields empty.
-
Click .
The record appears in the list with a label while we send it to the registry. You can’t add another DS record until that finishes.
Note
If the page isn’t available for your domain, its TLD doesn’t support DNSSEC at DNSimple. Contact support if you’re not sure.
Note
To add a DS record with the DNSSEC API, check out our developer documentation.
Removing a DS record
Note
This page only lists DS records you added. DS records that DNSimple manages for you when we sign your zone aren’t shown here. To remove those, disable DNSSEC.
To remove a DS record
-
Use the account switcher at the top of the page to select the appropriate account.
-
From your list, click the domain name to access its management page.
-
Click the tab on the left.
-
Click in the card, at the bottom of the page.
-
On the page, find the record and click the trash icon.
-
Click to confirm.
The record shows a label until the registry removes it. Deletion takes at least 24 hours because of the DS record’s TTL, and can take longer depending on the registry.
Note
To remove a DS record with the DNSSEC API, check out our developer documentation.
Have more questions?
If you have any questions or need help managing your DS records, just contact support, and we will assist you. You can also read more about domain and DNS security at DNSimple.