DNSSEC DS Record Builder

How to use DNSSEC DS Record Builder

Calculate SHA-256 or SHA-384 DS records from a public DNSKEY field, with canonical DNS owner bytes and a key tag. Keep the zone owner, DNSKEY algorithm and flags explicit. Download draft parent-zone records and compare their digest with a separate DNSSEC administration workflow before publishing.

1. Provide dnskey owner name, dnskey public-key base64, ttl in seconds.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• Only ASCII LDH owner labels and the root dot are supported. Labels are lowercased and expanded without compression; escaped, wildcard, relative-origin and Unicode zone syntax are refused. Use already validated ASCII IDNA labels if needed.
• Accepts non-revoked zone-key flags 256/257, fixed protocol 3 and algorithms 8/10/13/14/15/16. SHA-256 DS type 2 and SHA-384 DS type 4 are available. No SHA-1 DS output or algorithm recommendation is provided.
• Public-key input is at most 10,000 characters and 4,096 decoded bytes. Fixed-width curve keys are checked for length only; RSA uses canonical integer fields and a 512–4,096-bit algorithm 8 or 1,024–4,096-bit algorithm 10 modulus structure profile. These checks do not prove mathematical key validity or present-day strength.
• TTL is a draft record attribute and does not enter the digest. It must be an integer from 0 to 2,147,483,647 seconds. Requires WebCrypto over HTTPS.
• No private key is needed. The tool does not retrieve DNSKEY records, verify signatures or a chain of trust, configure a registrar, or publish changes. A matching DS digest alone does not prove a safe or live delegation.
• Inputs are processed on this device and are not automatically saved or uploaded.