DS record
A DS (Delegation Signer) record is a DNSSEC record published in a parent zone that holds a cryptographic hash of a child zone's DNSKEY, letting a validating resolver confirm the child's signing key is the one the parent actually delegated to, without needing any prior trust relationship with the child zone itself. It is the link that turns a chain of individually signed zones into a single chain of trust running from the DNS root down to a specific domain, defined alongside the rest of DNSSEC in RFC 4034 and RFC 4035. A domain adds DNSSEC by signing its own zone and then asking its registrar to publish a matching DS record at the parent; skipping that second step leaves the zone signed but unverifiable, since resolvers have no way to confirm the child's key is genuine.
By AdminKit team, Netbase JSC · Updated