Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a DS record; why is it submitted to the registrar in DNSSEC?
Short answer
The DS (Delegation Signer) record is the record that holds the digest of the signing key of the child zone in the parent zone (RFC 4034). The DNSSEC chain of trust starts from the root and each zone vouches for the next one with a DS record: the DS record in the .com zone validates the key of example.com. For this reason, after DNSSEC is turned on in a zone, the DS record is submitted to the parent zone, in practice to the registrar where the domain is registered; if it is not submitted, validating resolvers treat the zone as unsigned and the signatures cannot be validated. In TR7 GTM, the DNSSEC lock in the Domains list opens the DNSSEC Info for window, whose DS records table gives the DS values with the Key tag, Algorithm, Digest type and Digest columns; in a cluster, a separate table is shown for each device and the DS records in both tables are entered at the registrar.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → service name → Domains → DNSSEC lock | DS Records table: Key Tag, Algorithm, Digest Type, Digest (DNSSEC) | The DS values to be submitted to the registrar; Algorithm and Digest type are shown with their name next to the numeric value |
| GTM → GTM Services → service name → Records → Add | Record Type = DS | Publishing, under a zone on TR7, the DS record of a signed child zone delegated to another server |
Fields of the DS Record
| Field | Meaning |
|---|---|
| Key tag | Short number that identifies the key whose digest is taken |
| Algorithm | Signature algorithm of the key (IANA number) |
| Digest type | Digest algorithm (e.g. 2 = SHA-256) |
| Digest | Digest of the key |
- Registrar forms usually ask for these four fields separately; the values are copied from the window as they are.
- Before DNSSEC is turned off, the DS record is removed from the registrar; if the zone is served unsigned while the DS stays in place, validating resolvers consider the responses invalid (SERVFAIL).
- When DNSSEC is turned off and turned on again, a new key is generated for the zone; the new DS values in the DNSSEC Info for window are entered at the registrar in place of the old ones.
Common Misconceptions
- "The DS record is added to TR7's own zone." The DS record of a zone is published in the parent zone; for its own zone, TR7 only generates and shows the values. The DS type on the Records screen is for the delegated child zones under a zone that TR7 hosts.
- "Without the DS being submitted, DNSSEC works partially." Since the chain of trust is broken, validating resolvers treat the zone as unsigned.
- "In a cluster, the DS of a single device is enough." Since the two devices sign with different keys, the DS records of both devices are submitted.
How it is done in the documentation
