The DNSSEC trust chain,
witnessed daily.

DS records by algorithm

Across the latest snapshot of all observed zones.

What counts as an event

• added — a delegation turns DNSSEC on: its first DS RRset appears in the parent zone.
• changed — the DS RRset differs from yesterday: a KSK or algorithm rollover, or a silent key swap.
• removed — the DS RRset is gone and the delegation goes insecure. The signal this project exists for.

Feeds

Everything on this page is generated from these files. No API keys, no rate games — plain HTTPS.

GET https://ds-watch.felixmertins.dev/data/index.json
GET https://ds-watch.felixmertins.dev/data/stats/<zone>/<date>.json
GET https://ds-watch.felixmertins.dev/data/events/<zone>/<year>/<date>.jsonl
GET https://ds-watch.felixmertins.dev/data/events/<zone>/dnskey/<date>.json

Event schema, one JSON object per line. rrsig_* carry the registry's own signatures over the DS RRset — each event is verifiable up to the root trust anchor, not just our claim:

{"v":1,"date":"2026-09-04","tld":"org","domain":"example.org",
 "event":"ds_changed",
 "before":[{"key_tag":12345,"algorithm":8,"digest_type":2,"digest":"ab…"}],
 "after": [{"key_tag":54321,"algorithm":13,"digest_type":2,"digest":"cd…"}],
 "rrsig_before":["ds 8 2 86400 20260712… 4217 org. K7c…"],
 "rrsig_after": ["ds 8 2 86400 20260719… 4217 org. Kkm…"],
 "gap_days":1,"source":"czds","run_id":"…"}

Source & terms

Built from ICANN CZDS zone data. This service republishes only derived, value-added data: per-delegation change events and daily aggregates — never full zone contents or bulk snapshots.

By using these feeds you agree not to use the data contrary to the CZDS Terms of Use §1.1 — in particular, not to reconstruct zone contents or harvest registration data.

Every data commit in the log is signed with the project's SSH key: dswatch-signing.pub (SHA256:fxe3ICHvmEUYHfTCaKCQiXKqYXj1s/KkPQK3lQl4uTs).

Questions, corrections, takedown requests: felix@mertins.dev.