What happens if the DS does not match a DNSKEY?

Validating resolvers treat the zone as bogus and return SERVFAIL — the domain disappears for most users.

Where do I change the DS record?

At your domain registrar, which publishes it in the parent (TLD) zone.

DS Lookup

A DS (delegation signer) record sits in the parent zone and links it to the child zone’s DNSSEC key, completing the chain of trust. This lookup shows the DS records the parent publishes for a domain.

When to use this: DNSSEC validation fails after a key change or a DNS provider move, or you want to confirm the registrar published your DS. Command prefix ds:

About the DS Lookup

Check the Delegation Signer records in the parent zone that link it to the child zone’s DNSSEC keys.

FAQ

What happens if the DS does not match a DNSKEY?: Validating resolvers treat the zone as bogus and return SERVFAIL — the domain disappears for most users.
Where do I change the DS record?: At your domain registrar, which publishes it in the parent (TLD) zone.