DS records at the parent

A DS record is the digest of your DNSSEC key that the parent zone publishes for your domain. Validators use that digest to confirm the DNSKEY on your nameservers matches what the TLD expects. When the hash and the live key disagree, validating resolvers return SERVFAIL instead of your records.

How parent, child, and validators fit together

Your zone is the child. It publishes DNSKEY records and the RRSIGs that sign your data, usually on ns1.logicweb.com and ns2.logicweb.com when we host DNS. The parent is the TLD side of the chain, reached through your registrar. That is where the DS record lives. A validating resolver fetches the DS from the parent, fetches the DNSKEY from the child, and checks that the hash matches. If the parent still has a DS while the child is unsigned, you get an orphan DS and SERVFAIL for anyone who validates. If you do not want DNSSEC at all, there should be no DS at the parent.

dig example.com DS +short

An empty answer means the parent treats the domain as unsigned. A non-empty answer shows the hash and algorithm in use. Compare that output with dig example.com DNSKEY against the authoritative server. On cPanel, AutoSSL and the DNSSEC tools show the DS values the registrar should publish. You paste those values in the registrar panel. Two panels, one matching hash.

Safe DNSKEY and DS rollover

Rollover is a short sequence with waiting built in. First introduce the new DNSKEY so both keys sign the zone. Wait at least as long as the DNSKEY TTL, and often longer, so caches can learn the new key. Next change the DS at the registrar to the new digest. Wait again for the parent change to propagate. Only then remove the old DNSKEY. Skipping a wait leaves a window where DS and DNSKEY disagree, and that window is an outage for validating networks, including many mobile carriers.

Enabling, disabling, and what TTL actually controls

When you enable DNSSEC, sign the zone first, wait for the new keys to be visible, then publish the DS at the registrar. Use the digest cPanel shows you. Do not invent a DS by hashing material yourself, and keep the algorithm one the TLD accepts. When you disable DNSSEC, remove the DS at the registrar before you unsign the zone in cPanel. If you unsign first and leave the DS in place, validating resolvers will SERVFAIL until that DS is deleted.

DS TTL is controlled by the TLD, not by the A-record TTL in your zone. Lowering an A TTL does not speed up a DS change. For the separate clock that applies to address records, see when to lower TTL.