{"id":40,"date":"2021-02-05T11:19:00","date_gmt":"2021-02-05T11:19:00","guid":{"rendered":"https:\/\/www.dns.computer\/blog\/?p=40"},"modified":"2026-07-15T11:36:18","modified_gmt":"2026-07-15T11:36:18","slug":"ds-record-explained","status":"publish","type":"post","link":"https:\/\/www.dns.computer\/blog\/ds-record-explained\/","title":{"rendered":"DS record explained"},"content":{"rendered":"\n

The DS record is a specific DNS record that is used to secure the DNS (DNSSEC). It uses cryptographic keys to verify zones from the DNSSEC chain of trust.<\/p>\n\n\n\n

What is DNSSEC?<\/strong><\/h2>\n\n\n\n

DNSSEC is the solution to secure, otherwise unsecured DNS. It is a chain of trust that uses a combination of public and private cryptographic keys to authenticate each step of DNS resolving processes. Starting from the authoritative name server, going through each step on the way, and checking that the DNS records to see if they are truly coming from the authoritative name server for the zone.<\/p>\n\n\n\n

How to check DS record?<\/a><\/em><\/p>\n\n\n\n

DS record explained<\/strong><\/h2>\n\n\n\n

DS record is short for delegation signer record. You need DS records to apply DNSSEC.

Create DS records for the sub-domains, and, later, you need to add them to the parent zone, together with NS records. That way, the zones below will be verified.

Inside the DS record, you will find the cryptographic DNSKEY hash that contains KSK (key signing key) and orientate, where is the next key in the chain of trust.

You need to sign the subdomains, to maintain the trust on all of the levels.<\/p>\n\n\n\n

Important note, if there are other DNS records already for a particular subdomain like MX, TXT, A, etc., you can\u2019t add a DS record. The only record that could and must exist for the subdomain are NS records.<\/p>\n\n\n\n

How to add a DS record?<\/strong><\/h2>\n\n\n\n

To be able to use DS records, your DNS provider must support DNSSEC and be enabled. Pay attention that not all the\u00a0TLDs<\/a>\u00a0support DNSSEC. You create the DS record inside your DNS provider\u2019s control panel. First, you need to create a Master DNS zone and add it there.

Later you will need to put it in your domain registrar account at the TLD level. Some DNS providers do this process for you, others don\u2019t, but the DS record must be at the highest level because that way, it can verify those below.<\/p>\n\n\n\n

What\u2019s inside a DS record?<\/strong><\/h2>\n\n\n\n