DS Record

In one line

The DS (Delegation Signer) record creates the chain of trust between a parent zone and a child zone in DNSSEC. It contains a hash of the child zone's KSK (Key Signing Key). The parent zone (e.g., .com) publishes a DS record that points to the child zone's (e.g., example.com) DNSKEY. Without a DS record in the parent, DNSSEC validation cannot proceed for the child zone.

Description

DS records live in the parent zone and contain a cryptographic hash (digest) of the child zone's KSK DNSKEY. When a resolver validates example.com, it fetches the DS record from .com, verifies it matches the DNSKEY in example.com, then uses that DNSKEY to verify RRSIG signatures on example.com's records. The root zone's trust anchor is the starting point – browsers and resolvers ship with the root KSK pre-configured.

Examples

dig example.com DS

dig @a.gtld-servers.net example.com DS

delv +rtrace example.com A

Related Record Types