Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I get this error:

Inconsistent security for - 
DS found at parent, but no DNSKEY found at child.


People can't access my site with google public DNS because of this. How do I solve this problem?

dig DS shows me this

; <<>> DiG 9.8.3-P1 <<>> DS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42223
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;       IN  DS

;; AUTHORITY SECTION:    14400   IN  SOA 2014030300 14400 3600 1209600 86400

;; Query time: 21 msec
;; WHEN: Tue Jun 10 11:20:41 2014
;; MSG SIZE  rcvd: 100
share|improve this question
so, why did you make your registrar enter a DS record for but did not include a KEY RR in your DNS zone? dig +short DS 42573 7 1 64A902AD0A20245BE24D70179BEEAFF22B719E3E – the-wabbit Jun 10 '14 at 9:31
I am not familiar with DS records and don't know how to do this. How and where do I have to do this? Do I have to do that in or with registrar? Or can I remove it? Because actually I don't even want to use it. – Sinan Samet Jun 10 '14 at 9:35
up vote 1 down vote accepted

The DS RR, which is the fingerprint of the public key for a DNSSEC-enabled zone, is entered in the uplevel zone (in your case com.) It also indicates that the zone in question indeed has been DNSSEC-enabled, so DNSSEC-aware resolvers will error out any request where a DS RR is present but no corresponding (and matching) RRSIG and DNSKEY records exist.

If you do not intend using DNSSEC, you should ask the registrar to remove the DS RRs for from the .com zone.

Some further reading on DNSSEC:

share|improve this answer
I would like to remove it but the company I bought the domain from says it has nothing to do with them and they can't do anything about it. The DS record is not there on my nameserver. But google dns still has it. As if they didn't update it. – Sinan Samet Jun 10 '14 at 9:58
@SinanSamet The DS RR, very much like the glue NS RR, is in the .com zone, not in "your" zone. If you have registered the domain at different company than the one hosting the DNS zone (the whois info suggests so - registrar is networking4all B.V. while the zone is hosted by, you should be asking the registrar for removal. – the-wabbit Jun 10 '14 at 10:05
The company finally admitted that it was their fault after giving the link of this question. Thanks for your help! – Sinan Samet Jun 10 '14 at 12:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.