.png&w=3840&q=75)
DNS4 min
What Is a DS Record and How Does It Enable DNSSEC?
NS
NameSilo Staff8/27/2026
Share
A Delegation Signer (DS) record is a DNS record stored at the parent domain registry (like .com) that authenticates a child domain's DNSSEC key. It contains a cryptographic fingerprint of the domain's Key Signing Key (KSK), establishing a secure chain of trust from the top-level registry down to your specific nameservers.
How the DS Record Binds Parent Registries to Child Zones
Your zone contains DNSKEY records representing your DNSSEC signing keys. The parent zone, typically your TLD's registry, publishes the DS record that authenticates those DNSKEYs.
When a validating resolver queries your domain, it retrieves your DNSKEY records and the DS record from the parent zone, then verifies the DS record correctly represents at least one of your DNSKEYs. If they match, the resolver trusts your zone's signatures. If not, it returns SERVFAIL and refuses to answer.
The DS record is the anchor point. Without it published correctly at the registry, there's no cryptographic link between your domain and the parent zone vouching for it.
Why It Matters: Stopping Cache Poisoning and MITM Attacks
Without DNSSEC, a resolver has no way to verify a DNS response actually came from an authoritative source. An attacker who injects a forged record into a resolver's cache can silently redirect every user querying that resolver, capturing credentials or serving malware for hours before the cache expires.
DNSSEC, anchored by the DS record, makes forged responses cryptographically invalid. A resolver validating against a correct chain of trust rejects tampered answers automatically, closing off cache poisoning and man-in-the-middle attacks at the protocol level.
Deconstructing DS Syntax
Most domains publish a DS record using four fields:
- Key Tag: A short numeric identifier for the specific key being referenced.
- Algorithm: The cryptographic algorithm used (commonly RSA/SHA-256 or ECDSA).
- Digest Type: The hashing method used to generate the fingerprint (typically SHA-256).
- Digest: The actual cryptographic hash of the DNSKEY, the fingerprint itself.
Some domain types instead use Pubkey, Flags, and Algorithm fields, depending on the registry's requirements for that TLD.
The Configuration Workflow
Step 1: Confirm your DNS provider supports DNSSEC signing. NameSilo's default nameservers don't currently sign zones, so for DNSSEC today, configure a third-party DNS provider (such as Cloudflare or Route 53) that generates DS records for you.
Step 2: Generate your DNSSEC keys at that DNS host. They provide the DS record values: Key Tag, Algorithm, Digest Type, and Digest.
Step 3: In NameSilo, go to Domain Manager, click the domain name, select the DNS tab, and scroll to the DNSSEC section.
Step 4: Enter the DS record values exactly as provided. A single mismatched digit causes validation failure.
Step 5: Wait for propagation, up to 48 hours, then test with an online DNSSEC validator.
Common Mistakes
The Golden Rule: never change nameservers or DNS hosts without removing the DS record first. DS records at the registry become invalid the moment your zone's DNSKEYs change or disappear, which happens whenever you switch DNS providers. If the old DS record is still published while your new host serves different keys (or none at all), every validating resolver worldwide returns SERVFAIL, and your domain becomes unreachable. The correct order: disable DNSSEC and remove the DS record, complete the change, then re-enable DNSSEC with the new provider's values.
Assuming DS record management works identically across all domains: DNSSEC management isn't available for every TLD. If the option appears disabled for a domain, that registry doesn't support DS record management for it.
What This Means for You
Manage DS records directly from your Domain Console, accessible via the blue globe icon next to any domain, where you can add, view, or remove records individually or all at once. Need a domain to secure with DNSSEC from the start? Search available names.
Frequently Asked Questions
What is a DS record in DNS?
A record at the parent registry authenticating your domain's DNSSEC signing key.
What does DS stand for in DNSSEC?
Delegation Signer.
How does a DS record establish a chain of trust?
It links the registry's trust down to your zone's DNSKEY records.
Where do I find my DS record values?
Your DNS provider generates them when you enable DNSSEC signing.
What happens if a DS record is incorrect?
Validating resolvers return SERVFAIL, making the domain unreachable.
Is a DS record required for DNSSEC?
Yes. Without it, the chain of trust from the registry is broken.
How do I delete a DS record before changing nameservers?
In Domain Console, delete individually or toggle DNSSEC off to remove all.
Does NameSilo support DS records?
Yes, for supported registries; default nameservers don't yet sign zones.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
.png&w=3840&q=75)
