Glossary · ENCheck a domain

DS record

A DS record helps DNSSEC verify DNS answers by linking a parent zone, a managed part of DNS, to a key in a child zone below it. “DS” means Delegation Signer. It helps a DNS lookup service that checks DNSSEC connect the parent's verified DNS data to the child's keys. This link is part of DNSSEC's chain of trust.

How does a DS record connect zones?

Suppose example.com is signed with DNSSEC. The parent .com zone stores a DS record for example.com. The DS record contains a digest, a digital summary of a particular DNSKEY in the child zone. This summary is one-way: it cannot be used to reconstruct the original key. A resolver can compare the digest with the child key and then use that key to validate signed records in the child zone.

The DS record belongs in the parent zone, while the corresponding DNSKEY is published in the child zone. If the parent DS does not match the active child key, validating resolvers may reject the domain's DNS answers. That is why key changes and DS updates must be coordinated through the DNS host and the registrar or registry that manages the parent-side data.

Is DS the same as DNSKEY?

No. DS is a parent-side reference to a child key; DNSKEY is the public-key record in the child zone. Together with signatures and the parent zone's own trust chain, they help DNSSEC validators verify that answers have not been altered.

Related terms