What is a DS record?

A DS (delegation signer) record is published in the parent zone and contains a hash of a child zone's DNSSEC key. It is the link that connects a signed domain to the chain of trust.

For example.com the DS record lives in the .com zone, not in example.com itself. It consists of a key tag, the signing algorithm number, the digest type and the digest of the child's key-signing DNSKEY. A validating resolver fetches the DS from the parent, fetches the DNSKEY from the child, and checks that they match before trusting the child's signatures.

Because the DS record is in the registry's zone, you submit it through your registrar, just like nameserver changes. Some DNS providers and registries automate this with CDS and CDNSKEY records that the parent polls.

A DS record that points at a key the zone no longer uses breaks the domain for every validating resolver. When moving a signed zone to a new DNS provider, the safe order is to remove the DS record (or go through a proper key rollover) and wait for its TTL to expire before switching nameservers.

Example

example.com.  86400  IN  DS  12345 13 2 <sha-256 digest of the DNSKEY>

Check it

See how DS record looks for a real domain:

DNS lookup