The DS record: the link that closes the DNSSEC chain

The DS (Delegation Signer) record is a hash of your zone’s key-signing key, stored in the PARENT zone — the same place as your delegation. It is how .com tells the world "this is the key example.com legitimately signs with". Your DNS provider generates the DS value; your registrar publishes it.

dig example.com DS +short

The two accidents

• DS present, keys gone ("orphan DS"): you moved DNS providers or disabled DNSSEC, but the old DS stayed at the registrar. Validating resolvers reject the domain immediately. Rule: remove the DS BEFORE changing nameservers or turning DNSSEC off.
• Keys present, no DS: the zone is signed but the chain never closes — nobody validates anything. Signing without publishing the DS is running the machinery for zero benefit.

The DS must also MATCH: it embeds a key tag and a digest of a specific key. Rotate your keys without updating the DS and the chain breaks just as hard as an orphan DS. Modern setups automate this with CDS/CDNSKEY records, but the failure mode is the same when automation is absent.