DS Lookup
Delegation Signer records held by the parent zone.
Enter a value above to run DS Lookup
e.g. cloudflare.com
Quick answer
A DS lookup returns the Delegation Signer records stored in the parent zone, which link a domain's DNSSEC keys into the chain of trust. Each DS record is a hash of the child zone's DNSKEY; if it is missing or does not match, DNSSEC validation for the domain fails.
A DS (Delegation Signer) record is the DNSSEC link between a zone and its parent. It lives in the parent zone (for example, the .com registry holds the DS record for example.com) and contains a hash of your zone's DNSKEY. This tool queries the parent side to show exactly which DS records are published for a domain. If you have enabled DNSSEC at your registrar, the DS is what proves resolvers can trust your signed answers. Missing or mismatched DS records are the single most common cause of DNSSEC validation failures.
How it works
The tool asks a resolver for the DS records at the delegation point, which are served by the parent zone's authoritative servers, not your own. Each record returned includes four fields: the key tag, the DNSSEC algorithm number, the digest type (usually 2 for SHA-256), and the digest itself. The key tag and algorithm must correspond to a DNSKEY in your zone, and the digest must be the hash of that key for the chain of trust to hold.
How to read the results
Read each DS as a pointer to one of your DNSKEYs. The key tag identifies which key it references, and the digest type tells you the hash algorithm. Prefer digest type 2 (SHA-256); type 1 (SHA-1) is deprecated. A domain may show more than one DS during a key rollover, which is normal and safe. An empty result means the parent publishes no DS, so DNSSEC is effectively off even if your zone is signed.
Common problems & fixes
The classic failure is a DS at the registrar that no longer matches your current DNSKEY, which makes resolvers return SERVFAIL. This happens after a key rollover where the old DS was removed too soon or the new one was never uploaded. Fix it by generating the DS from your active KSK and updating it at the registrar. Also confirm the algorithm number matches; a DS pointing to an algorithm your zone does not use breaks validation.
Frequently asked questions
- What is the difference between a DS and a DNSKEY record?
- The DNSKEY lives in your own zone and holds the public key used to verify signatures. The DS lives in the parent zone and contains only a hash of that key. The parent cannot store your full key, so it stores the DS as a compact fingerprint. Together they build the chain of trust from the root down to your domain.
- Why does my domain return no DS record?
- Either DNSSEC was never enabled at your registrar, or the DS was removed. Signing your zone alone is not enough; you must also submit the DS to the parent through your registrar. Until that DS is published, resolvers treat the domain as unsigned and skip validation. Generate the DS from your KSK and upload it at your domain provider.
- How many DS records should a domain have?
- Usually one or two. One is the steady state, pointing to your active key-signing key. Two appear temporarily during a KSK rollover, when the old and new keys briefly coexist so resolvers keep validating through the transition. After the rollover completes, remove the stale DS. More than two is rarely needed and only adds risk of a mismatch.