What Is a DS Record? DNSSEC Delegation Explained

What Is a DS Record?

A DS record (Delegation Signer record) is a critical component of DNSSEC (Domain Name System Security Extensions). It creates a chain of trust between an upper-level zone and a delegated zone by containing a hash of the delegated zone’s DNSKEY record.

The Basics

• DS stands for “Delegation Signer”
• Published in the upper-level zone (e.g., .com for example.com)
• Contains a hash of the delegated zone’s public key
• Enables cryptographic verification of DNS responses
• Part of the DNSSEC trust chain

Why DS Records Matter

Without DNSSEC, DNS responses can be spoofed (DNS cache poisoning). DS records help ensure:

• DNS responses haven’t been modified
• Responses come from authoritative servers
• A chain of trust from root servers to your domain

Understanding DNSSEC

Before diving deeper into DS records, let’s understand DNSSEC:

The Problem DNSSEC Solves

Traditional DNS has no authentication. A malicious actor could:

• Intercept DNS queries
• Return fake IP addresses
• Redirect users to malicious sites

How DNSSEC Works

1. Zone signing — DNS zone is signed with private key
2. Public key published — DNSKEY record contains public key
3. DS in upper zone — Hash of DNSKEY stored in upper-level zone
4. Verification — Resolvers verify signatures using keys

DNSSEC Record Types

Record	Purpose
DNSKEY	Contains public key for the zone
DS	Hash of delegated zone’s DNSKEY in upper-level zone
RRSIG	Cryptographic signature for records
NSEC/NSEC3	Proves non-existence of records

How DS Records Work

The Chain of Trust

Root Zone (.)
    ↓ DS record for .com
.com Zone
    ↓ DS record for example.com
example.com Zone
    ↓ DNSKEY signs all records
Signed DNS Responses

DS Record Structure

example.com.    3600    IN    DS    12345 13 2 49FD46E6C4B45C55D4AC69CBD3CD34AC1AFE51DE...

Component	Value	Description
Name	example.com	Domain name
Key Tag	12345	Identifier for the DNSKEY
Algorithm	13	DNSSEC algorithm (13=ECDSA P-256)
Digest Type	2	Hash algorithm (2=SHA-256)
Digest	49FD46E6C4B45C55D4AC…	Hash of DNSKEY

Algorithm Numbers

Common DNSSEC algorithms:

Number	Algorithm
8	RSA/SHA-256
10	RSA/SHA-512
13	ECDSA P-256 (recommended)
14	ECDSA P-384
15	Ed25519

Digest Types

Number	Algorithm
1	SHA-1 (deprecated)
2	SHA-256 (recommended)
4	SHA-384

Implementing DNSSEC

Prerequisites

1. DNS provider supports DNSSEC — Must be able to sign zones
2. Registrar supports DS records — Must accept DS submissions
3. Understand key management — Keys need rotation

Implementation Steps

Step 1: Activate DNSSEC at DNS Provider

Most managed DNS providers handle signing automatically:

• Cloudflare: One-click activation in DNS settings
• AWS Route 53: Activate signing in hosted zone
• Azure DNS: Configure DNSSEC signing

Step 2: Retrieve DS Record Values

After activating DNSSEC, your provider gives you DS record values:

Key Tag: 12345
Algorithm: 13
Digest Type: 2
Digest: 49FD46E6C4B45C55D4AC69CBD3CD34AC1AFE51DE...

Step 3: Add DS Record at Registrar

Submit DS record values to your domain registrar. This publishes the DS record in the upper-level zone (.com, .net, etc.).

Step 4: Verify DNSSEC

# Check DS record in upper-level zone
dig DS example.com

# Verify DNSSEC chain
dig +dnssec example.com

# Use online validators
# - dnsviz.net
# - dnssec-analyzer.verisign.com

Example: Cloudflare DNSSEC Setup

1. Go to DNS settings in Cloudflare dashboard
2. Click “Activate DNSSEC”
3. Cloudflare provides DS record values
4. Add these values at your registrar
5. Wait for propagation (can take up to 24 hours)

Example DS Record Values

; From Cloudflare
Key Tag: 2371
Algorithm: 13 (ECDSAP256SHA256)
Digest Type: 2 (SHA-256)
Digest: 7a892bc4539428f...

; What gets published in .com zone
example.com.    86400    IN    DS    2371 13 2 7a892bc4539428f...

Best Practices for MSPs

1. Start with Low-Risk Domains

Don’t activate DNSSEC on critical domains first. Test with:

• Development domains
• Non-production environments
• Lower-traffic sites

2. Understand the Risks

DNSSEC misconfigurations can break DNS entirely:

• Missing or invalid DS record — Validation fails
• Key rollover issues — Old keys invalidate signatures
• TTL mismatches — Can cause validation windows issues

3. Use Managed DNSSEC When Possible

Providers like Cloudflare handle:

• Key generation and rotation
• Zone signing
• Algorithm selection

You only need to add the DS record at the registrar.

4. Monitor DNSSEC Status

Set up alerts for:

• DS record mismatches
• Signature expiration
• DNSSEC validation failures

# Check DNSSEC validation
dig +dnssec +short example.com

# Look for 'ad' flag (Authenticated Data)
dig +dnssec example.com | grep flags

5. Plan Key Rollovers

DNSSEC keys should be rotated periodically:

• ZSK (Zone Signing Key): Every 1-3 months
• KSK (Key Signing Key): Every 1-2 years

Important: KSK rollover requires updating DS records at the registrar.

6. Keep TTLs Appropriate

During DNSSEC implementation, consider:

• Lower TTLs before changes
• Ensure DS record TTL allows for propagation
• Old signatures must remain valid during transitions

Frequently Asked Questions

Do I need DNSSEC for my domains?

DNSSEC adds security against DNS spoofing attacks. It’s increasingly important for:

• Financial services
• Healthcare
• Government
• E-commerce

However, misconfigurations can break DNS entirely. Weigh the security benefits against operational complexity.

What happens if DNSSEC validation fails?

Validating resolvers (like 8.8.8.8 and 1.1.1.1) will return SERVFAIL, and the domain becomes unreachable. This is why correct implementation is critical.

Can I deactivate DNSSEC once it’s configured?

Yes, but carefully:

1. Remove DS record from registrar first
2. Wait for TTL expiration (24-48 hours)
3. Then turn off signing at DNS provider

Deactivating in the wrong order causes validation failures.

How do I know if DNSSEC is working?

# Check for AD (Authenticated Data) flag
dig +dnssec example.com

# Use online tools
# - dnsviz.net/d/example.com
# - dnssec-analyzer.verisign.com

Who manages the DS record — registrar or DNS provider?

The DNS provider generates the DS record values by signing the zone. You then submit these values to the registrar, who publishes them in the upper-level zone.

Does DNSSEC affect performance?

Minimally. DNSSEC adds:

• Larger DNS responses (signatures)
• Additional validation at resolver
• Generally unnoticeable for end users

---

Get Started with Unified DNS

DNSSEC implementation requires careful attention to DS records across multiple domains. Unified DNS lets you view, modify, audit, and backup all DNS records — with automated backups protecting your configurations and Hudu syncing keeping your security documentation up to date.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.