Overview
To publish a DNSSEC Delegation Signer (DS) record through your domain registrar, provide four values from UltraDNS: Key Tag, Algorithm, Digest Type, and Digest.
A DS record links the parent zone to your domain's DNSSEC public key. Your registrar is the company through which you manage your domain registration. Submit the DS information to your registrar for publication in the parent zone.
When to Use This Article
- Your registrar requests DS record information for your domain.
- You need to identify the values in an UltraDNS DS record.
- You need to select the SHA-256 DS record for publication.
Before You Begin
- Your domain must be signed in UltraDNS, and the DS Resource Records section must be populated.
- You need access to your registrar's domain management interface or assistance from the registrar's support team.
Find the DS Record in UltraDNS
- Log in to the UltraDNS Managed Services Portal.
- Click Domains.
- Select your domain.
- Click the DNSSEC tab.
- Locate the DS Resource Records section.
- Locate the SHA-256 record, identified by Digest Type
2. - Copy the complete record or its four values, depending on what your registrar requests.
Understand the Required DS Fields
The four values appear in this order:
Key Tag Algorithm Digest Type Digest
| Field | Meaning | What to Provide |
|---|---|---|
| Key Tag | A number from 0 through 65535 used with the algorithm and digest to identify the referenced DNSKEY record. |
The Key Tag shown in the selected DS record. |
| Algorithm | The numeric identifier of the cryptographic algorithm in the referenced DNSKEY record. | The Algorithm shown in the selected DS record. |
| Digest Type | The numeric identifier of the hash algorithm used to calculate the digest. |
2 for the SHA-256 DS record. |
| Digest | The hexadecimal hash calculated from the DNSKEY owner name and DNSKEY record data. | The complete Digest shown in the selected DS record. Copy every character. |
Algorithm and Digest Type are separate fields. Copy each value from its corresponding field in the selected UltraDNS DS record.
Provide the Record to Your Registrar
- Open your registrar's DNSSEC or DS record management interface, or contact the registrar's support team.
- Identify the domain for which you are publishing the DS record.
- Provide the Key Tag, Algorithm, Digest Type, and Digest from the same SHA-256 DS record in UltraDNS.
- Follow your registrar's instructions to submit the record for publication.
Check the Submitted Information
Compare the DS information saved by your registrar with the selected SHA-256 DS record in UltraDNS. Confirm that all four values match, including the complete Digest.
Ask your registrar to confirm that the DS record has been published in the parent zone. Matching values in the registrar's interface alone do not confirm publication or successful DNSSEC validation.
Important Notes
- UltraDNS creates DS records for SHA-1 and SHA-256. Use the SHA-256 record, identified by Digest Type
2, for publication. - Do not submit a new SHA-1 DS record. Current IANA guidance prohibits SHA-1 for DNSSEC delegation.
- Use the values displayed for your domain. Do not substitute values from an example or another domain.
- If your registrar cannot accept the displayed values, ask the registrar to confirm its supported DS submission requirements. Do not change the values to fit the registrar's form.
- Click the question mark icons in the UltraDNS portal for additional field information.