---
title: "List DNSSEC DS records for a domain you own"
method: GET
path: "/api/domains/{domain}/dnssec"
tags: ["DNS"]
---

# List DNSSEC DS records for a domain you own

`GET /api/domains/{domain}/dnssec`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/domains/{domain}/dnssec`
- Auth: HTTP bearer

Returns the DNSSEC delegation-signer (DS) records published at the registry for a domain you own, and whether DNSSEC is enabled. Pairs with TLSA records (set via the DNS endpoint) for DANE.

## Path parameters

- `domain` string, required

## Response `200`

DNSSEC DS records for the domain

- object
  - `domain` string
  - `enabled` boolean: True when at least one DS record is published
  - `records` DsRecord[]
    - `keyTag` string, required: Key Tag identifying the DNSKEY
    - `algorithm` string, required: DNSSEC algorithm number (e.g. 13 = ECDSAP256SHA256, 8 = RSASHA256)
    - `digestType` string, required: Digest type number (e.g. 2 = SHA-256)
    - `digest` string, required: Hex digest of the DNSKEY

## Other responses

- `401`: Missing or invalid API key
- `403`: Forbidden
- `404`: Domain not found
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)