DS Lookup
Retrieve the DS records published in a domain's parent zone - the fingerprints that anchor its DNSSEC chain of trust to the DNSKEY it signs with.
About DS Lookup
A DS record (Delegation Signer) is the link between a domain and its parent. Unlike most records, it does not live in the domain's own zone: it is held by the parent - for example the .eu registry for example.eu - and is set through your registrar. Each DS record contains a hash of one of the domain's DNSKEY records, so that a validating resolver descending from the root can confirm the child's keys are the ones the parent vouches for.
DS Lookup fetches those records from the delegation and shows the four fields of each one: the key tag identifying the referenced DNSKEY, the algorithm number, the digest type and the digest itself in hexadecimal. Digest type 2 (SHA-256) is the current standard, type 4 is SHA-384, and type 1 (SHA-1) is deprecated and should be replaced. A domain may publish more than one DS record - for instance during a KSK rollover, when the old and new keys briefly coexist.
The chain of trust works top-down: the root signs the TLD, the TLD's DS record vouches for your domain, and your DS must match a DNSKEY in your zone. If the DS points to a key that is no longer published - a classic failure after a botched rollover - validating resolvers return SERVFAIL and the domain becomes unreachable for a large slice of the internet. To check for exactly this, compare the key tag and algorithm shown here against the DNSKEY set from our DNSKEY Lookup tool; they must line up.
The query is resolved from our EU-based recursive servers, so you get an independent view of the delegation without relying on your registrar's control panel, and without your lookups being tracked by an external service.
How to use it
- 1Enter the domain you want to check, such as example.eu, and run the lookup.
- 2Read each DS record's four fields: key tag, algorithm, digest type and digest hash.
- 3Confirm the digest type is 2 (SHA-256) or 4 (SHA-384) rather than the deprecated type 1 (SHA-1).
- 4Note the key tag, then open our DNSKEY Lookup tool for the same domain and check that a DNSKEY with the matching tag and algorithm exists.
- 5If no DS record is returned, the parent delegation is unsigned - DNSSEC is not active for the domain even if it publishes DNSKEY records.
Common use cases
- -Verify that DNSSEC is fully enabled by confirming the registrar actually pushed a DS record to the parent zone.
- -Troubleshoot SERVFAIL errors caused by a DS record that references a retired or missing DNSKEY.
- -Plan a KSK rollover by watching for the new DS to appear alongside the old one before removing it.
- -Audit a migration between registrars, making sure the DS is re-published in the new delegation.
- -Detect deprecated SHA-1 (digest type 1) DS records that need to be upgraded to SHA-256.
Frequently asked questions
- What is a DS record?
- A DS (Delegation Signer) record is a DNSSEC record stored in a domain's parent zone that contains a hash of one of the domain's DNSKEY records. It lets validating resolvers confirm that the domain's keys are trusted by the level above it.
- Where is the DS record published?
- In the parent zone, not the domain's own zone. For example.eu it lives in the .eu registry and is managed through your domain registrar, which is why you cannot add or change it in your normal DNS hosting.
- What do the four fields in a DS record mean?
- They are the key tag (which DNSKEY it refers to), the algorithm number, the digest type (2 for SHA-256, 4 for SHA-384, 1 for the deprecated SHA-1), and the digest, a hexadecimal hash of the referenced key.
- Why is my domain returning SERVFAIL after enabling DNSSEC?
- The most common cause is a DS record that no longer matches any published DNSKEY, usually after a key change. Compare the DS key tag here with your DNSKEY records; if they do not match, validating resolvers reject the zone.
- No DS record was found - is that a problem?
- It means DNSSEC is not active for the domain. Publishing DNSKEY records alone does nothing until a matching DS record is added to the parent zone through your registrar to complete the chain of trust.