DS record (Delegation Signer)

The DNSSEC record that connects a zone to its parent: it publishes a hash of the zone's signing key so resolvers can build an unbroken chain of trust from the root.

What it stores

A DS (Delegation Signer) record lives in the parent zone and contains a cryptographic hash of the child zone's Key-Signing Key (DNSKEY). Resolvers use it to verify that the child's keys are authentic, extending DNSSEC validation down the delegation chain.

Why it matters

Without a matching DS record at the parent, a signed zone is not actually validated — DNSSEC is effectively off.
It is the hand-off point most likely to break during a DNSSEC key rollover.

Common mistakes

Publishing DNSKEY records but never uploading the DS to the registrar, so validation never engages.
Rolling keys without updating the DS, causing a validation failure (SERVFAIL) for everyone.

How WebInspect checks this

The Network Inspector reports DNSSEC status, including whether a DS/chain of trust is present.