How to check DNSSEC DS and DNSKEY records with dig

A signed child zone can keep serving ordinary records while validating resolvers return SERVFAIL because the parent still points to an old key. Comparing the parent-side DS RRset with the DNSKEY RRset from every child authority isolates that delegation break before another signing or registrar change adds uncertainty.

A DS record contains a key tag, DNSSEC algorithm, digest type, and digest. The dig +multiline display adds each DNSKEY key ID, so the tag and algorithm identify a candidate key; the derived digest must also match because a key tag alone is not unique.

The public example uses internetsociety.org., one authoritative org. server, and both current child authorities. Substitute the current parent and child servers for the zone under review, repeat the child query for every listed authority, and use dnssec-dsfromkey from the BIND utilities package for the cryptographic digest comparison.

Related: How to check DNSSEC validation with dig
Related: How to trace DNS delegation with dig
Tool: DNSSEC Validator

Steps to check DNSSEC DS and DNSKEY records with dig:

  1. List the authoritative servers for the parent org. zone. 
    $ dig org. NS +short
a0.org.afilias-nst.info.
a2.org.afilias-nst.info.
b0.org.afilias-nst.org.
b2.org.afilias-nst.org.
c0.org.afilias-nst.info.
d0.org.afilias-nst.org.
  2. Query @a0.org.afilias-nst.info directly for the child zone's signed DS RRset. 
    $ dig @a0.org.afilias-nst.info internetsociety.org. DS +dnssec +norecurse +noall +comments +answer
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37767
;; flags: qr aa; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; ANSWER SECTION:
internetsociety.org.  3600  IN  DS  2371 13 2 39FDC63793DB261F978F59086A5D1D17BDE3B5A32E2A4D55C8ECE602 7D969C33
internetsociety.org.  3600  IN  RRSIG  DS 8 2 3600 20260730154208 20260709144208 13950 org. bQz3j/cLFX+GtJUkx+30aQN+Gdei3EWLroYaHxLeZqd3sHuoH5eoMoU3 zEG9OZWgWcgx9nHQi1liQVW6FM4yqBvYm4mz8DPLOzSaubcZaEQuj7Ah /IkBXfDrMix3wYo5fJLJL32g8ErOiGzME/mffGkk8/3x/4+ZVcX8EbUB iMQ=

    The aa flag confirms a parent-authoritative answer. The DS fields identify key tag 2371, algorithm 13, digest type 2, and the SHA-256 digest.

  3. List the authoritative servers for internetsociety.org.. 
    $ dig internetsociety.org. NS +short
aron.ns.cloudflare.com.
yahir.ns.cloudflare.com.
  4. Query @aron.ns.cloudflare.com directly for the signed DNSKEY RRset. 
    $ dig @aron.ns.cloudflare.com internetsociety.org. DNSKEY +dnssec +norecurse +multiline +noall +comments +answer
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13633
;; flags: qr aa; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; ANSWER SECTION:
internetsociety.org.  3600 IN  DNSKEY 257 3 13 (
                mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+Gq
                JxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
                ) ; KSK; alg = ECDSAP256SHA256 ; key id = 2371
internetsociety.org.  3600 IN  DNSKEY 256 3 13 (
                oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeq
                CYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
                ) ; ZSK; alg = ECDSAP256SHA256 ; key id = 34505
internetsociety.org.  3600 IN  RRSIG DNSKEY 13 2 3600 (
                20260906153601 20260707153601 2371 internetsociety.org.
                oLIRegfnpfLRJ3C4LlsFvfm4guS8JhkbC1TwKJTukvNp
                ku+KTNWMFRLbz7NxpjUzh6XHIS/x/qNYSOSEbiH3PA== )

    The KSK comment shows key ID 2371 and algorithm 13, matching the first two DS fields. The RRSIG DNSKEY record shows that the RRset is signed by the same key ID.

  5. Query @yahir.ns.cloudflare.com directly for the signed DNSKEY RRset. 
    $ dig @yahir.ns.cloudflare.com internetsociety.org. DNSKEY +dnssec +norecurse +multiline +noall +comments +answer
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29887
;; flags: qr aa; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; ANSWER SECTION:
internetsociety.org.  3600 IN  DNSKEY 257 3 13 (
                mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+Gq
                JxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
                ) ; KSK; alg = ECDSAP256SHA256 ; key id = 2371
internetsociety.org.  3600 IN  DNSKEY 256 3 13 (
                oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeq
                CYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
                ) ; ZSK; alg = ECDSAP256SHA256 ; key id = 34505
internetsociety.org.  3600 IN  RRSIG DNSKEY 13 2 3600 (
                20260906153601 20260707153601 2371 internetsociety.org.
                oLIRegfnpfLRJ3C4LlsFvfm4guS8JhkbC1TwKJTukvNp
                ku+KTNWMFRLbz7NxpjUzh6XHIS/x/qNYSOSEbiH3PA== )

    Both child authorities return the same DNSKEY and RRSIG data. A missing key, different key ID, or different public-key data on one server indicates an inconsistent rollout.

  6. Save one authoritative DNSKEY RRset as a temporary partial zone file. 
    $ dig @aron.ns.cloudflare.com internetsociety.org. DNSKEY +norecurse +noall +answer > internetsociety.org.dnskey
  7. Generate a SHA-256 DS record from the saved DNSKEY RRset. 
    $ dnssec-dsfromkey -2 -f internetsociety.org.dnskey internetsociety.org.
internetsociety.org. IN DS 2371 13 2 39FDC63793DB261F978F59086A5D1D17BDE3B5A32E2A4D55C8ECE6027D969C33

    The derived key tag, algorithm, digest type, and digest match the parent DS record exactly. During a key rollover, accept the delegation when every parent DS record derives from a currently published child DNSKEY and every child authority serves the intended key set.

  8. Remove the temporary DNSKEY file after the comparison. 
    $ rm internetsociety.org.dnskey
  9. Query a validating resolver to confirm that the matched delegation authenticates the signed zone. 
    $ dig @1.1.1.1 internetsociety.org. A +dnssec +noall +comments +answer
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58885
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; ANSWER SECTION:
internetsociety.org.  255  IN  A  104.18.16.166
internetsociety.org.  255  IN  A  104.18.17.166
internetsociety.org.  255  IN  RRSIG  A 13 2 300 20260713231852 20260711211852 34505 internetsociety.org. 6gBrH+BpWxjWSf7IEPAYk2vpJsUZdXOaMYOpWGbwFJReiEmX+/V/af6F ReqWwPeXyGN8VY3ywwh0Opwoh0u4lA==

    The NOERROR status and ad flag show that the resolver authenticated the signed answer through the matched parent and child records. Address values, TTLs, transaction IDs, and signatures can change between queries.