DS record (Delegation Signer) is how DNSSEC bridges the trust boundary between a parent zone and a child zone. The parent publishes a DS record containing the hash of the child’s DNSKEY. A resolver validating a signed answer walks up the chain: child DNSKEY → parent DS → grandparent DS → root DS.
Record Format
example.com. DS 12345 13 2 A1B2C3D4E5F6...Fields: key tag, algorithm number, digest type, digest.
The Chicken-and-Egg Problem
The DS record must be published in the parent zone (e.g., the .com zone) — you can’t do this via DNS alone. You submit the DS record to your registrar, who forwards it to the registry via EPP. Until the DS lands in the parent, DNSSEC on your domain is “islanded” and validators treat it as unsigned.
Rotation
When you rotate the DNSKEY, you must also update the DS in the parent. Fail to coordinate and the whole zone goes SERVFAIL for validating resolvers.
Related
Check the DNSSEC glossary entry, read every major DNS record type, and see the nameserver definition.