Free DS Record Lookup & Checker
| Domain | Type | Primary NS | Responsible Person | Serial | Refresh | Retry | Expire | Minimum | TTL |
|---|
| Name Server | IP Address | TTL |
|---|
| Domain | Type | TTL | Record Value |
|---|
| Trace Result |
|---|
| Domain | Type | Record | Status |
|---|
| Domain | Type | Record | Status |
|---|
Check live DS DNS records, TTL values, and trace the full root-to-authoritative resolution path.
DS (Delegation Signer) Records Overview
What is a DS record?
A DS record is part of DNSSEC. It is published in the parent zone and contains a hash of a child zone’s DNSKEY, creating a chain of trust from the parent down to the child.
Why do you need a DS record?
DS records let resolvers verify that a child zone’s DNSSEC keys are authentic, securing the delegation against tampering.
DS record structure
A DS record includes a key tag, algorithm, digest type, and digest. Example: example.com. 86400 IN DS 2371 13 2 32996839a6d808af...
How to create a DS record?
Your DNS host generates the DS data from your DNSKEY. You then submit the DS record to your domain registrar, which publishes it in the parent (TLD) zone to enable DNSSEC.
FAQs
DS Record Troubleshooting & Common Fixes
Total domain outage (SERVFAIL) after migrating DNS hosting provider
When you switch DNS hosts or point nameservers elsewhere without updating or removing DNSSEC at your registrar, the parent TLD registry keeps serving your previous provider's DS record. Because the new nameservers sign with different keys (or lack DNSSEC completely), the cryptographic chain of trust breaks and all security-validating resolvers refuse to resolve your website.
Key Tag, Algorithm, or Digest mismatch between parent and child zone
DNSSEC validation requires an exact cryptographic match between the DS record in the parent registry (e.g. .com) and the Key Signing Key (KSK) DNSKEY in your child zone. A single typo in the Key Tag or an incorrect Algorithm ID (such as Algorithm 8 RSA vs 13 ECDSA Curve P-256) causes immediate validation failure.
2 (SHA-256) or 4 (SHA-384) matching your key hash.
Registrar dashboard says “Active” but parent TLD registry shows no DS record
Many domain registrars queue DNSSEC updates or require pre-validation tests before sending the DS record to the TLD registry via EPP. If your child nameservers are unreachable or un-signed, the registry rejects the submission and your domain remains unprotected.
clientHold or registry flags. Ensure your authoritative nameservers are actively answering queries with valid RRSIG signatures before re-submitting the DS record. Note that TLD registry updates typically take between 1 and 24 hours to replicate across all root and TLD nameservers.
