Matches a key
Each DS record names a key signing key that the domain publishes.
Free DS record lookup
See the DS records the parent zone holds for a domain, which link it to the domain's own keys.
- Free, with no signup
- Runs in your browser
What your result means
No DS record
The parent zone holds no DS record, so the domain is not signed, or its keys never reached the registry.
Names a missing key
A DS record points to a key the domain does not publish, so validating resolvers fail.
Questions about the DS lookup
Where does the DS record live?
In the parent zone, such as .com, not in your own DNS. You add it at your registrar, which sends it to the registry.
I moved DNS hosts. Do I change the DS record?
Yes, if the new host signs with new keys. Replace or remove the old DS record, or the domain stops resolving for validating resolvers.
What do the digest types mean?
The hash used to make the DS record from the key. SHA-256 is the current standard.
Found a problem? We will check the rest.
Book a deliverability audit and we will look at every domain and mailbox you send from.