Add a SHA-256 DS record

Why it matters

The only DS record at your registrar uses the SHA-1 digest type, which is deprecated and no longer recommended. A DS record with a SHA-256 digest of the same key is a drop-in replacement.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Get a DS record with digest type 2 (SHA-256) for the same key. Your DNS provider shows it, or you can compute it from the DNSKEY with the dnssec-dsfromkey tool.
2. At the registrar, add the SHA-256 DS record next to the old one. Do not remove the old one first.
3. After the new record has been published for longer than its TTL, and DNSViz shows a clean chain, remove the SHA-1 DS record.
4. If a problem appears, remove the new record and keep the old one.

dig +short DS example.com
dig +short DNSKEY example.com | head -n 2
# compute a SHA-256 DS from the KSK (flag 257) of the zone
# dnssec-dsfromkey comes with the BIND utilities (package bind9-utils on Debian and Ubuntu)
dig DNSKEY example.com | dnssec-dsfromkey -2 -f - example.com

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DNSSEC check
• Repair broken DNSSEC so validating resolvers can resolve the domain
• Make your DNSSEC signatures something resolvers can validate
• Publish the DS record at your registrar
• Find out why resolvers disagree about your DNSSEC
• Turn on DNSSEC
• Move DNSSEC to a stronger signing algorithm