> `dig ds $domain` Amusingly for this method to work the resolver must understand DNSSEC. This is because DS records exist solely at the parent side of a deleg

> `dig ds $domain` Amusingly for this method to work the resolver must understand DNSSEC. This is because DS records exist solely at the parent side of a delegation. A resolver that is not aware of DNSSEC will look to the child as it would for any other kind of record type.