ADVERT
🛡️ DS Record Checker
Check DS records to confirm DNSSEC delegation between parent and child zones and review key digests.
DS Record Checker
Check delegation signer records at the parent zone to ensure DNSSEC trust chains are intact.
What you'll see
- Key tags, digest types, and hashed values exactly as seen by validating resolvers.
- TTL information so you know when parent zone changes will propagate globally.
- Authority details indicating which registry or TLD server delivered the DS response.
Common use cases
- Confirm a new DS record is live after enabling DNSSEC with your registrar.
- Compare DS digests with DNSKEY data before and after a key rollover.
- Diagnose SERVFAIL responses caused by mismatched or missing DS entries.
DNS Resolver
Check DS (Delegation Signer) records to confirm DNSSEC delegation from the parent zone.
Prepared query:
example.comTroubleshooting tips
- The key tag and algorithm must match an active DNSKEY published in the child zone.
- During key rollovers, publish multiple DS records temporarily so validators accept both generations.
- Remove retired DS records once traffic confirms the new keys are trusted to prevent confusion.
FAQ
- What does a DS record do?
- Delegation signer records connect your domain's DNSKEYs to the parent zone. Validators use them to build the DNSSEC trust chain.
- Why do I see multiple digests?
- Registries often allow several DS records so you can stage or roll keys. Keep both active until the rollover completes, then remove the old digest.
ADVERT
ADVERT