support DS records for DNSSEC