Domains & DNS
DNSSEC DS records: how the parent zone links to your DNS keys
A DNSSEC DS record is the parent-zone pointer that lets a validating resolver trust a child zone key. Publishing a DS is not the same as enabling a DNSSEC switch; the values must be derived from the active key and remain coordinated through key or DNS-provider changes.
Know where the DS record belongs
The child DNS provider publishes DNSKEY records; the registrar or parent zone publishes the DS. Adding a DS-looking record inside the child zone does not create the parent chain of trust.
For .ca, .com, and other TLDs, the registrar interface and supported algorithms/digests can differ.
Match key tag, algorithm and digest
Copy the DS values exactly from a trusted DNS provider output or calculate them from the intended DNSKEY. A single wrong digest produces validation failure after the parent publishes it.
Check which DNSKEY is acting as the key-signing key when the provider exposes multiple keys.
Verify after parent publication
Query the parent delegation and a validating resolver after the DS becomes visible. Confirm the chain reaches the active DNSKEY and a signed record under the domain validates successfully.
Keep authoritative service stable while parent caches age.
Plan provider changes around DS removal/replacement
Changing nameservers while an old DS remains can make the new unsigned or differently signed zone unreachable to validating clients. Coordinate old/new signing state and parent DS before moving delegation.
- DS lives at the parent.
- Use values from the active key.
- Validate the full chain after publication.
- Coordinate DS during nameserver moves.