DS Record Lookup

What is a DS record?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

A DS (Delegation Signer) record is published in the parent zone, through your registrar, and holds a hash of your zone's DNSSEC signing key. It links your domain into the DNSSEC chain of trust. This lookup shows each DS record's key tag, algorithm, digest type and digest.

DNSSEC needs both halves: your DNS provider signs the zone and publishes DNSKEY records, and the registrar publishes a DS record that matches one of those keys. No DS record means DNSSEC is not active for the domain, even if the zone is signed.

A DS record that matches no current DNSKEY is worse than none: validating resolvers treat the domain as bogus and return SERVFAIL. Use the DNSSEC checker to test validation end to end.

How do I check a domain's DS record?

Enter the domain, for example example.com.
Compare the key tag, algorithm and digest with the DS values your DNS provider shows.
Run the DNSSEC checker to confirm the chain validates.

How to read the results

key_tag: A short identifier of the DNSKEY this DS refers to.
algorithm: The DNSKEY algorithm number: 8 is RSA/SHA-256, 13 is ECDSA P-256/SHA-256, 15 is Ed25519.
digest_type: The hash used: 2 is SHA-256 (recommended), 4 is SHA-384, 1 is SHA-1 (deprecated).
digest: The hash of the DNSKEY, in hex.

Common DS record problems

Domain stopped resolving after a DNS provider change

The old DS record still points at the previous provider's key. Remove it or replace it with the new provider's DS at the registrar.

DNSSEC enabled at the provider but not working

The DS record was never added at the registrar. Copy the DS values from the provider into the registrar's DNSSEC settings.

Examples and command-line equivalents

Compare DS and DNSKEY

dig +short DS example.com
dig +short DNSKEY example.com
dig +dnssec +multi example.com DNSKEY

Frequently asked questions

Where do I add a DS record?

At your registrar, usually under DNSSEC settings, not in your DNS zone. Some registrars that also host DNS add it automatically.

Which DS digest type should I use?

SHA-256 (digest type 2). SHA-1 (type 1) is deprecated, and publishing only a SHA-1 DS is not recommended.