What is DNSSEC? How DS and DNSKEY records build a chain of trust

Most signed zones use two kinds of key. The key signing key (flags 257) signs only the set of keys. The zone signing key (flags 256) signs everything else. Splitting them lets a zone change its everyday key without asking the parent to change anything.

The DS record at the parent names the key signing key by its key tag, a short number worked out from the key itself (RFC 4034), and adds a hash of it. Digest type 2, SHA-256, is the common one. RFC 9904, the current list of DNSSEC algorithms, says new DS records must not use SHA-1 (type 1). For signing, it recommends algorithm 8 (RSA with SHA-256), 13 (ECDSA P-256 with SHA-256) and 15 (Ed25519). Cloudflare signs with algorithm 13, which keeps keys and signatures small.

A resolver that checks DNSSEC starts from the root's key, which it already trusts, and follows the DS records down. When every signature holds, it sets the AD (authenticated data) flag on the answer. When one fails, it answers SERVFAIL instead of handing out data it can't trust. Cloudflare's and Google's public resolvers both check. DNSSEC doesn't encrypt anything, though. It proves where an answer came from, and anyone on the path can still read it.

The usual way to break DNSSEC is moving a domain to a new DNS host while the old DS record stays at the registrar. The new host signs with different keys, the DS record points at a key nobody publishes anymore, and every checking resolver answers SERVFAIL for the whole domain. Cloudflare's docs say to remove the DS record at the registrar before you change name servers.

Open More records in the DNS Lookup to see a domain's DS and DNSKEY records. The tool works out each key's tag, checks that the DS record points at a key the domain publishes, and says whether the domain is signed, not signed or broken. DS and DNSKEY records only exist at the top of a zone, so look up example.com, not www.example.com.