DS Record Generator

How to use

1. 1Keep the Build from DNSKEY tab selected and paste the child zone's DNSKEY record. A full line from dig DNSKEY example.com works, or just the flags protocol algorithm key data. Use the Key Signing Key (flags 257).
2. 2Confirm the zone name. It is read from the pasted line when present, and the digest is computed over this exact owner name, so it must match the DNSKEY.
3. 3Choose the digest types to generate. SHA-256 (digest type 2) is selected by default and recommended; add SHA-1 only for parents that still need it.
4. 4Read the computed key tag and copy the DS record data, the full zone-file line, or the registrar field values, then publish them at your domain's registrar (the parent zone).
5. 5Switch to Parse and explain to paste an existing DS record and confirm the key tag, algorithm, digest type, and digest length are all valid.

About this tool

DS Record Generator builds the DNSSEC Delegation Signer record from a child zone's DNSKEY, and parses an existing one in plain English. A DS record is the link in the DNSSEC chain of trust: it lives in the parent zone (which is why registrars ask for it when you turn DNSSEC on) and publishes a fingerprint of the child zone's Key Signing Key. A resolver that already trusts the parent reads the DS record, then fetches the child's DNSKEY, confirms it matches, and only then trusts the signed answers from that zone. The record data is three small numbers and a hex digest: key tag, algorithm, digest type, and digest. The key tag is a 16-bit fingerprint of the DNSKEY computed from its bytes with the reference algorithm in RFC 4034 Appendix B, and getting it by hand is fiddly, so this tool computes it for you. The algorithm is the DNSKEY's own signing algorithm number copied verbatim (8 for RSA/SHA-256, 13 for ECDSA P-256, 15 for Ed25519, and so on); it is not the digest algorithm, which is a common point of confusion. The digest type is the hash used for the digest: 1 for SHA-1, 2 for SHA-256 (the recommended default from RFC 4509), or 4 for SHA-384 (RFC 6605). The digest itself is that hash applied to the canonical wire form of the owner name concatenated with the DNSKEY record data, which means the owner name must match the DNSKEY exactly, down to the trailing labels. The mechanical work this tool removes is real: it encodes the owner name into canonical wire format with length-prefixed, lowercased labels and a terminating zero octet, rebuilds the DNSKEY record data from the flags, protocol, algorithm, and the base64-decoded public key, computes the key tag, and hashes the result with SHA-1, SHA-256, or SHA-384 using the Web Crypto API. In the Build tab you paste the child zone's DNSKEY, either a full zone-file line straight from dig or just the flags, protocol, algorithm, and key, pick which digest types to emit, and the tool shows the key tag, each DS record's data, a full zone-file line with the hex wrapped the way dig and BIND display it, the four fields laid out the way a registrar DNSSEC form asks for them, and snippets for BIND, Route 53, and Google Cloud DNS. It flags a deprecated signing algorithm and reminds you that the DS record should fingerprint the Key Signing Key (flags 257), not the Zone Signing Key. The Parse tab takes an existing DS record, names the algorithm and digest type, and checks that the digest length matches the digest type, so a SHA-256 record that is not 32 bytes is caught before it breaks a delegation. Two things make DNSSEC actually work: publish the DS record at your registrar (the parent), not inside the child zone, and during a key rollover keep both DS records live, one per key tag, until the old key is retired. Everything runs locally. DNSKEY public keys are public by design, no private key is ever needed, and nothing you paste is uploaded or logged. No DNS queries are made.

Free to use. Works in your browser. No signup, no login.