DNSKEY to DS Record Converter
Convert raw DNSKEY public keys into Delegation Signer (DS) hashes. Calculate RFC 4034 Key Tags and generate formatted DS records ready to paste into Cloudflare, GoDaddy, Namecheap, and AWS Route 53.
Calculated DNSSEC Parameters
Key Tag: 2371Registrar Form Values to Copy
Frequently Asked Questions
What is the mathematical purpose of a Delegation Signer (DS) record?
A DS record is published in the parent zone (such as .com or .org) to bridge the cryptographic chain of trust to the child zone. It contains a cryptographic hash (digest) of the child zone Key Signing Key (KSK DNSKEY), proving that child records are authentic.
How is the RFC 4034 DNSKEY Key Tag calculated?
The Key Tag is a 16-bit checksum calculated by summing consecutive 16-bit words of the DNSKEY wire-format RDATA (flags, protocol, algorithm, and public key bytes) with an accumulator carry over modulo 65535.
Which DNSSEC Digest Type should I choose at my registrar?
Digest Type 2 (SHA-256) is the global industry standard and supported by all top-level domain registries. Digest Type 4 (SHA-384) is used for high-security ECDSA P-384 keys. Digest Type 1 (SHA-1) is deprecated due to collision risks.
What is the difference between Flag 256 (ZSK) and Flag 257 (KSK)?
Flag 257 denotes a Key Signing Key (KSK) whose public hash is placed in the parent zone DS record. Flag 256 denotes a Zone Signing Key (ZSK) used on a daily basis to sign zone records (RRSIG). Only KSK keys (Flag 257) should be converted into parent DS records.