How to create a chain of trust for delegated third-party zones.
When setting up DNS zone delegation for parent and child zones that are managed through Address Manager, Address Manager automatically creates all necessary resource records for the zones. However, Address Manager doesn't automatically create DNSSEC resource records for delegated zones that are on third-party servers that are outside of your control. In this case, either send the KSK public key to the administrator of the parent zone or you can manually create a DS record for the delegated child zone. You create the DS record by specifying the child zone name and key data.
For example: you manage the parent zone example.com and deploy it to the managed server ns1.example.com. You also want to set up delegation for the zone child.example.com on the third-party server ns10.example.com. The server ns10.example.com is outside of your control and is not managed by Address Manager.
In this example, you configure DNS zone delegation as you would for any zone that's outside of your control. For information on configuring zone delegation for this example, refer to DNS zone delegation.
To configure the trust anchor for the child zone, you need to add a DS record to the parent zone.
To add a DS record to a zone: