Search... ⌘ K
Get Started Contact Sales

What Are DS Records?

Last updated

A Delegation Signer (DS) record is a critical DNSSEC record that connects your domain’s cryptographic identity to the global DNS system. It acts as a trusted reference from your parent zone (like .com or .org) to your domain’s Key Signing Key (KSK) by containing a cryptographic digest (hash) of that key.

This digest enables DNS resolvers to verify the authenticity and integrity of your DNSKEY without requiring access to the key itself. The DS record extends DNSSEC’s chain of trust by letting the parent zone “vouch” for your domain’s keys.

The DNS hierarchy

To understand DS records, it is important to understand how the DNS system is structured.

  • At the top is the root zone (“.”).
  • Below that are top-level domains (TLDs) like .com, .net, or .org, known as parent zones.
  • Below that are your domains, like example.com, referred to as child zones.

In a DNSSEC-enabled setup, each layer can validate the one below it. The DS record allows the parent zone to securely delegate trust to your domain by linking to your domain’s DNSSEC keys.

Why DS records matter

When DNSSEC is enabled for your domain, DNS resolvers can verify that your DNS records have not been forged or modified. This is possible because your records are cryptographically signed using private keys, and the matching public keys (your KSK and ZSK) are published in your zone as DNSKEY records.

But publishing a DNSKEY alone is not enough. For DNS resolvers to trust your DNSKEY, they need a verified reference to it from the parent zone. That is the role of the DS record.

Without a DS record in the parent zone, or if the DS record does not match your current KSK, DNS resolvers will reject your domain’s DNSSEC signatures. This can make your domain unreachable to users using DNSSEC-validating resolvers.

How DS records establish trust

Enabling DNSSEC involves a series of steps that lead to the creation and publication of a DS record.

Here is how it works:

  1. Generate DNSSEC keys

    When you enable DNSSEC on your domain at DNSimple, we create two key pairs:

    • Key Signing Key (KSK): Used to sign the DNSKEY record set
    • Zone Signing Key (ZSK): Used to sign your actual DNS records (like A, MX, etc.)

    Both keys are published as DNSKEY records, but the KSK is the one trusted by the parent zone.

  2. Create the DS record

    A cryptographic digest (hash) is generated from your domain’s KSK. This becomes the DS record. It includes details about the algorithm and digest type used, but it does not expose your full key.

  3. Publish the DS record in the parent zone

    The DS record is submitted to your domain registrar, who publishes it through the domain registry (like .com or .org). Once the DS record is live in the parent zone, it links your domain to the rest of the DNSSEC chain of trust.

  4. Resolver validates the chain of trust

    When a DNSSEC-aware resolver queries your domain, it:

    • Retrieves the DS record from the parent zone
    • Fetches the DNSKEY records from your zone
    • Compares the DS digest to your KSK

The resolver creates a digest of the DNSKEY using the same hash algorithm and digest type specified in the DS record. Even though the DS record does not contain the full public key, it includes a cryptographic hash of it. By hashing the DNSKEY locally and comparing it to the digest in the DS record, the resolver can confirm the two are linked.

If the created digest matches the DS record, the resolver trusts your DNSKEY and the DNS records it signs. If they do not match (for example, if an error crept in while copying the DS record to your registrar), resolvers will not trust your domain’s DNSSEC signatures, and your domain may become unreachable.

DS-data vs. KEY-data

DNSKEY records contain a zone’s public KSK and ZSK. DS records contain a digest of the public KSK. The contents of these records are stored in different formats:

  • DNSKEY records store the public key itself, in KEY-data format
  • DS records store a digest of the KSK, in DS-data format

When you set up DNSSEC on a child zone, registries and registrars may ask for your zone’s KSK in either format. When you add a DS record for a domain registered with DNSimple, you can enter either the DS-data fields (key tag, algorithm, digest type, and digest) or the KEY-data fields (algorithm and public key).

Here is how they work:

KEY-data format

The KEY-data format refers to the actual public key information stored in DNSKEY resource records, which forms the foundation of DNSSEC’s cryptographic authentication system.

The DNSKEY RDATA consists of:

Flags
Set to either 257 to indicate it is a Key-Signing Key, or 256 to indicate it is a Zone-Signing Key

Protocol
Always 3, indicating DNSSEC.

Algorithm
Indicates the cryptographic algorithm used to generate the key. Zones signed by DNSimple use algorithm 8 (RSA/SHA-256).

Public Key
The full public DNSKEY. This is used to derive the digest and validate signatures.

For example, a DNS query for DNSKEY records could provide an answer like this:

dig DNSKEY howdnssec.works +short

256 3 8 AwEAAd8wHn5TTNBlMyuyjs5YQ04z3L1st+mio0uzeJqKsHS0UNERd348 FgUaJCiOAqK6LAWaSAJZPxSoLyDL89jAuGloL1G8O4LLDn0g2p6BK+8N T7FaQ+M1KFyj2fF7+yA2TzUkNdDJ91OFsmuUKa/3O2GhsY6HiOBcP0N9 Kt2dK3o5
257 3 8 AwEAAeA7Li6vTqYQb2+5JPRWVSKYb/dX0yDRPnl8h6QMdmqc1LzXia8j wUVvLXfaZUPc6UgV+f7jOg+PSGNcD8XbetDSxJE0oAmhWZk2OaU1BBgY f6ejnIyD3MWnVPB55kwrsrcZP5nEuSEC9TzoGp7xv6FrVCWxRUw6BbBi JtYjL/at2YocWxpfNunj104AeMdMEIrIg+j3sRLzI+jWrO8Aydc=

In this answer, we can see that the howdnssec.works zone has two DNSKEY records with the following RDATA:

  • KSK - Flags: 257, Protocol: 3, Algorithm: 8, Public key: AwEAAeA...O8Aydc=
  • ZSK - Flags: 256, Protocol: 3, Algorithm: 8, Public key: AwEAAd8...dK3o5

Your results will show different values. DNSimple rotates DNSSEC keys automatically, so the keys and key tag for a zone change over time.

DS-data format

The DS-data format represents a cryptographic digest (hash) of a DNSKEY record, specifically designed to establish trust between parent and child zones in the DNS hierarchy.

The DS RDATA consists of:

Key Tag
A short numeric identifier that helps locate the corresponding DNSKEY.

Algorithm
Indicates the cryptographic algorithm used to generate the key. Zones signed by DNSimple use algorithm 8 (RSA/SHA-256).

Digest Type
Specifies the hash algorithm used to generate the digest. Commonly 2 (SHA-256).

Digest
A hash (digest) of the public part of the KSK. This is what the parent zone publishes.

If we check the DS record for the same domain, here is what we might see:

dig DS howdnssec.works +short

2360 8 2 DD405275324638EFE40925D44F815C9828C231464D18F7A18A975F5A 98D0C50B

In this answer, we can see that the howdnssec.works zone has a DS record with the following RDATA:

Key Tag: 2360, Algorithm: 8, Digest type: 2, Digest: DD40527...98D0C50B

Learn more

To learn more about DNSSEC, see What Is DNSSEC?. For step-by-step instructions on managing DS records, see Add and Remove DS Records. For information about managing DS records when changing DNS providers, see Manage DS Records When Changing DNS. For information about DNSSEC key rotation, see Rotate DNSSEC Keys. For a complete overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.

Have more questions?

If you want to explore more DNSSEC terms, take a look at our DNSSEC Glossary. Ready to get started with DNSSEC? Read Enable DNSSEC. If you have further questions or need any assistance, contact our support team, and we will be happy to help. You can also read more about domain and DNS security at DNSimple.