Key Tag (16-bit fingerprint)
Short fingerprint of the KSK the DS covers. Matches a specific DNSKEY at the child zone.
DS Record Lookup — verify the DNSSEC chain of trust for any domain.
Query DS (Delegation Signer) records at the parent zone. DS is the DNSSEC trust link — root signs the TLD's DS, TLD signs your DS, your DS signs your DNSKEY, your DNSKEY signs every record in your zone. If any link in the chain is broken, DNSSEC validation fails and modern resolvers refuse to trust your domain. This tool walks the chain end-to-end and reports where the break is (if any).
01 · TRY IT
Look up a DS record
Enter any domain. Empty answer set = DNSSEC not deployed. Non-empty answer set = signed; the tool walks the full chain of trust for you.
02 · WHAT IT RETURNS
What the DS lookup shows
Algorithm (Crypto suite)
8=RSASHA256 (still common), 13=ECDSAP256SHA256 (modern default), 15=Ed25519 (new best-practice). RSASHA1 (5, 7) is deprecated.
Digest Type (Hash algorithm)
1=SHA-1 (deprecated), 2=SHA-256 (standard), 4=SHA-384 (higher security). SHA-1 should be removed.
Digest (The hash)
Hex-encoded hash of the KSK. Length depends on digest type — 40 chars for SHA-1, 64 for SHA-256, 96 for SHA-384.
Chain of trust walked (End-to-end)
Verifies root → TLD → parent → your DS → your DNSKEY. Any missing or broken link is flagged with the specific hop that fails.
AI verdict on posture (Production-ready?)
Cross-checks algorithms + digest types against current best practice. Flags legacy RSASHA1/SHA-1 that should be rotated out.
03 · WHY IT MATTERS
When to check DS
- DNSSEC deployment verification You just enabled DNSSEC at your registrar — this tool confirms the DS records were actually published at the parent zone (registrars sometimes silently fail this step).
- Key-rollover safety check Rolling KSK? Publish both old + new DS in parallel, wait for TTL, remove the old. This tool verifies the overlap window is correct.
- Broken-DNSSEC triage 'Users on Google DNS (8.8.8.8) can't reach my site.' Almost certainly a broken DNSSEC chain — 8.8.8.8 validates DNSSEC and returns SERVFAIL on failures.
- Registrar-migration DNSSEC continuity Moving DNS between registrars? DS handoff is the tricky step — this tool confirms the new registrar has published matching DS values before you decommission the old.
- Algorithm-modernization audit Legacy DS records using RSASHA1 or SHA-1 digests should be rotated to ECDSAP256SHA256 or Ed25519. This tool flags what needs upgrading.
04 · QUESTIONS
Common questions
- What is a DS record? DS (Delegation Signer) is a DNSSEC record at the parent zone that hashes the child zone's Key Signing Key (KSK). It's the link in the chain of trust — root signs TLD's DS, TLD signs your DS, your DS signs your DNSKEY, your DNSKEY signs your zone.
- How do I know if a domain has DNSSEC? Query for DS records at the domain. Non-empty answer = DNSSEC deployed. This tool also chases the chain to confirm the DS actually validates against the parent's signature.
- Why are there multiple DS records? Either key-rollover overlap (publishing DS for both old and new KSK during transition) or different digest algorithms (SHA-256 alongside SHA-1 for legacy compat). Both are normal.
- What breaks DNSSEC? DS at the parent not matching the DNSKEY at the child, expired DNSKEY signatures, missing NSEC/NSEC3 records, or a broken chain higher up (registrar issues). Any break = validation fails, some resolvers return SERVFAIL.
- Does my registrar need to support DNSSEC? Yes — the DS record has to be published at the parent (the TLD), which the registrar submits on your behalf. Not all registrars support DNSSEC. Cloudflare, Google Domains (via Squarespace), Route 53, and Gandi all do.
05 · RELATED
Related security + DNS tools
TLSA (DANE) Lookup (Depends on DNSSEC)
DNS-backed cert pinning — only meaningful with DNSSEC.
WHOIS / RDAP (Registrar view)
Full domain lookup including DNSSEC posture flag.
SOA Record Lookup (Zone master)
See the zone's SOA and NS alongside DS.
DNS Query (All Records) (Super tool)
Full DNS dump — DS alongside every other record.