Skip to main content
Book Consultation →
DNSSEC100% FreeInstant

DS Record Lookup: Check the DNSSEC Delegation Signer

This free DS record lookup shows the delegation signer records published at the parent of a domain and checks each one against the domain DNSKEY. A mismatch usually means DNSSEC is broken.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is a DS Record?

A DS record, or delegation signer, is a fingerprint of a domain’s key signing key that is stored at the parent zone. For example, the DS record for example.com lives in the .com zone. It links the two zones together and lets resolvers trust the keys your domain publishes.

DNSSEC works as a chain of trust from the root zone down to your domain. The DS record is the link between your zone and its parent. If it is missing or wrong, the chain breaks, and validating resolvers refuse to answer for the domain.

How to Use This DS Record Lookup

  1. Enter your domain, such as example.com.
  2. Choose a resolver that validates DNSSEC, such as Google, Cloudflare or Quad9.
  3. Press Lookup DS.
  4. Read the table. The last column compares each DS record with the keys published by your own zone.

The Fields of a DS Record

FieldMeaning
Key tagIdentifies the DNSKEY this record refers to.
AlgorithmThe signing algorithm of that key, for example 13 for ECDSA P-256.
Digest typeThe hash used for the fingerprint. 2 is SHA-256 and is the usual choice.
DigestThe fingerprint itself, shown in hexadecimal.

The tool calculates the digest from your DNSKEY and compares it with the published value. A match proves that the parent and your zone agree. The format is described in RFC 4034, the DNSSEC resource record specification.

How to Add or Update a DS Record

  1. Turn on DNSSEC signing at your DNS provider. It gives you the DS values.
  2. Log in to your domain registrar.
  3. Find the DNSSEC or DS record section and enter the key tag, algorithm, digest type and digest.
  4. Save, wait for the parent zone to update, then run this lookup again.

Common DS Problems

  • No DS record found. DNSSEC is not active for the domain, or the registrar has not published it yet.
  • DS does not match the DNSKEY. This often follows a DNS provider change. Update the DS record at the registrar, or remove it before moving DNS.
  • The domain stops resolving. A bad DS record can make the domain look bogus to validating resolvers. Fix or remove the record quickly.
  • Old digest type. SHA-1 digests are deprecated. Replace them with SHA-256.

View the keys that the DS record points to with the public key viewer, and confirm which servers answer for your domain with the name server lookup. When you move DNS providers, plan the DNSSEC change carefully and test it with the full health report.

When a DS Record Lookup Helps Most

A DS record lookup is the fastest check after any DNSSEC change. Run it after enabling DNSSEC, after moving to a new DNS provider and after rotating keys. If the result shows a match, the chain of trust is intact. If it does not, you can fix the registrar entry before visitors notice.

Keep this DS record lookup bookmarked. Domains that fail DNSSEC validation can disappear for users of validating resolvers, and the cause is almost always a stale DS entry.

Frequently Asked Questions

A DS record is a fingerprint of a domain key signing key. It is stored at the parent zone and links the parent to the child in the DNSSEC chain of trust.
Add it at your domain registrar. Your DNS provider shows the values to copy once DNSSEC signing is turned on.
Validating resolvers treat the domain as bogus and return an error, so the site and email can become unreachable for many users.
SHA-256, digest type 2, is the widely supported choice. SHA-1 is deprecated, and SHA-384 is valid but less common.

Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.