---
title: "Return domain's DS records"
method: GET
path: "/DNSSEC/fetch_ds_records"
tags: ["DNSSEC", "DNS Security"]
---

# Return domain's DS records

`GET /DNSSEC/fetch_ds_records`

This function fetches a domain's Delegation of Signing (DS) records.

**Important:**

When you disable the [DNS role](https://go.cpanel.net/serverroles), the system **disables** this function.

## Query parameters

- `domain` string, domain, required

## Response `200`

HTTP Request was successful.

- object
  - `apiversion` integer — The version of the API.
  - `func` string — The name of the method called.
  - `module` string — The name of the module called.
  - `result` object
    - `data` object
      - `additionalProperties` object — An object containing the domain's DS record information. **Note:** The return's name is the domain's name.
        - `keys` object — The DS keys on the requested domain.
          - `additionalProperties` object — The information related to the domain's DNSSEC record. **Note:** The return's name is the `key_tag` return's integer value.
            - `active` 0 | 1 — Whether the DS key is active. * `1` - Active. * `0` - Inactive.
            - `algo_desc` string — A description of the algorithm that the DS key uses.
            - `algo_num` 5 | 6 | 7 | 8 | 10 | 13 | 14 — The algorithm the system generated for the security key. * `5` - RSA/SHA-1 * `6` - DSA-NSEC3-SHA1 * `7` - RSASHA1-NSEC3-SHA1 * `8` - RSA/SHA-256 * `10` - RSA/SHA-512 * `13` - ECDSA Curve P-256 with SHA-256 * `14` - ECDSA Curve P-384 with SHA-384
            - `algo_tag` string — The short-form reference to the algorithm.
            - `bits` integer — The DS key's size, in bits.
            - `created` integer — The key's creation time.
            - `digests` object[] — The information that the registrar uses to populate the DS records.
              - …
            - `flags` 256 | 257 — An integer that determines the `key_type` value. * `256` - A Zone Signing Key (ZSK). * `257` - A Combined Signing Key (CSK) or Key Signing Key (KSK).
            - `key_id` integer — PowerDNS's internal identifier.
            - `key_tag` integer — The DS key's identification number.
            - `key_type` 'CSK' | 'KSK' | 'ZSK' — The DS key's signing type. * `CSK` - Combined Signing Key. * `KSK` - Key Signing Key. * `ZSK` - Zone Signing Key.
            - `privatekey` string — The DS key's private key, in ISC format.
        - `nsec_details` object — An object containing the [Next Secure Record](https://tools.ietf.org/html/rfc4470) (NSEC) information for the selected domain. **Note:** If the domain uses NSEC semantics, only the `nsec_version` return appears in the object.
          - `nsec3_hash_algo_desc` string — A description of the NSEC3 key's algorithm.
          - `nsec3_hash_algo_num` integer — The DNSSEC Digest Algorithm Number.
          - `nsec3_iterations` integer — The number of times that the system rehashes the first hash operation.
          - `nsec3_narrow` 0 | 1 — Whether NSEC3 will operate in Narrow or Inclusive mode. * `1` - Narrow mode. * `0` - Inclusive mode. **Note:** For more information about these modes, read [PowerDNS's DNSSEC documentation](https://doc.powerdns.com/authoritative/dnssec/intro.html).
          - `nsec3_opt_out` 0 | 1 — Whether NSEC3 will create records for all delegations or only for secure delegations. * `1` - Create records for all delegations. * `0` - Create records only for secure delegations.
          - `nsec3_salt` string, hex — The salt value that PowerDNS uses in the hashes. **Note:** For more information about the salt value, read [RFC 5155](https://tools.ietf.org/html/rfc5155#section-3.1.5).
          - `nsec_version` 'NSEC' | 'NSEC3' — Whether the domain uses NSEC or [Next Secure Record version 3](https://tools.ietf.org/html/rfc5155) (NSEC3) [Domain Name Security Extensions](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) (DNSSEC) semantics. * `NSEC` * `NSEC3`
    - `errors` string[], nullable — List of errors if the API failed.
    - `messages` string[], nullable — List of messages generated by the API.
    - `metadata` object
    - `status` 0 | 1 — * `1` - Success * `0` - Failed: Check the errors field for more details.
    - `warnings` string[], nullable — List of warnings generated by the API. Warnings describe non-critical failures or other problematic conditions noted while running a API.

---

[API](https://skmtc.net/cpanel/apis/cpanel-uapi.md) · [All operations](https://skmtc.net/cpanel/apis/cpanel-uapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cpanel/cpanel-uapi/revisions/632e2f8e6d04/schema)