DS
type 43RFC 4034DS (Delegation Signer, type 43, RFC 4034) establishes the chain of trust between a parent zone and a child zone. The DS record in the parent zone (e.g., .com) contains the cryptographic hash of the child zone's KSK DNSKEY record. When a resolver validates example.com, it verifies that the DS record in .com matches the KSK in example.com's DNSKEY RRset, then uses that KSK to verify the child zone's signatures.
Details
DS records are the anchor points of the DNSSEC chain of trust.
Chain of trust path: Root zone (.) → .com DS validates .com DNSKEY → example.com DS validates example.com DNSKEY → example.com RRSIG validates A/MX/etc.
DS record location: The DS record is published in the PARENT zone, not the child zone. For example.com, the DS record is in .com. For sub.example.com, the DS record is in example.com.
DS digest types: 1 = SHA-1 (deprecated, do not use) 2 = SHA-256 (widely deployed, current standard) 4 = SHA-384 (RFC 6605, more secure)
Publishing a DS record: The zone administrator generates the DS record hash from the KSK DNSKEY record and submits it to the registrar (e.g., Cloudflare Registrar, Namecheap, GoDaddy). The registrar submits it to the TLD registry (.com, .net). The TLD registry publishes the DS record in the parent zone.
DS record vs DNSKEY: The DS record contains only the HASH of the DNSKEY, not the key itself. This keeps the parent zone compact (DS is ~40-80 bytes vs 2048-bit RSA key ~300 bytes).
Key tag: Identifies which DNSKEY the DS record corresponds to. Matches the DNSKEY Key Tag field. Used by resolvers to find the right key to hash and compare.
CDS and CDNSKEY (RFC 7344): Child-side records that signal to the parent that the DS record should be updated. Allows automated KSK rollover without manual registrar interaction. Supported by most modern registrars.
Wire format fields
| Field | Description |
|---|---|
| Key Tag | 16-bit key tag of the referenced DNSKEY. Calculated from the DNSKEY RDATA. Used to identify the correct key. |
| Algorithm | Same algorithm value as the referenced DNSKEY (e.g., 13 for ECDSAP256SHA256). |
| Digest Type | Hash algorithm: 1=SHA-1 (deprecated), 2=SHA-256, 4=SHA-384. |
| Digest | Cryptographic hash of the DNSKEY owner name + DNSKEY RDATA using the specified digest algorithm. |
Zone file example
; DS record for example.com, published in .com zone ; Created by hashing the example.com KSK DNSKEY example.com. IN DS 12345 13 2 ( 49FD46E6C4B45C55D4AC69CBD3CD34AC 1F1CF25DCA33C49E78BE61A0C7D95872 ) ; 12345 = key tag ; 13 = algorithm (ECDSAP256SHA256) ; 2 = digest type (SHA-256) ; ... = SHA-256 hash of the KSK ; Generate DS from DNSKEY: ; dnssec-dsfromkey -a SHA-256 /path/to/Kexample.com.+013+12345.key ; OR: dig DNSKEY example.com +dnssec | dnssec-dsfromkey -f - example.com ; Check DS in parent: ; dig DS example.com @a.gtld-servers.net