DNSKEY
type 48RFC 4034DNSKEY (type 48, RFC 4034) holds the public key used to sign a DNS zone. Each zone has at least two keys: the Zone Signing Key (ZSK, flags=256) used to sign individual RRsets, and the Key Signing Key (KSK, flags=257) used to sign the DNSKEY RRset itself. The KSK's hash is published as a DS record in the parent zone, forming the chain of trust from the root zone down.
Details
DNSKEY records are published by each DNSSEC-signed zone to allow resolvers to verify signatures.
Two key types: KSK (Key Signing Key, flags=257, SEP bit set): Signs the DNSKEY RRset for the zone. Its SHA-256 or SHA-384 hash is published as a DS record in the parent zone (e.g., the .com zone). Infrequently rotated (annually or less) because DS record changes require parent zone coordination.
ZSK (Zone Signing Key, flags=256): Signs all other RRsets in the zone (A, MX, CNAME, etc.). More frequently rotated (monthly to quarterly) because rotation is zone-internal. Smaller key typically used (1024-bit RSA or P-256 ECDSA).
Algorithm numbers (IANA-assigned): 5 = RSA/SHA-1 (deprecated) 7 = RSASHA1-NSEC3-SHA1 8 = RSA/SHA-256 (widely deployed) 10 = RSA/SHA-512 13 = ECDSA Curve P-256 with SHA-256 (recommended, smaller keys) 14 = ECDSA Curve P-384 with SHA-384 15 = Ed25519 (RFC 8080, smaller, faster) 16 = Ed448
Key tag: A 16-bit value calculated from the public key material. Used as a quick lookup hint in DS and RRSIG records to identify which key to use. Not cryptographically secure -- just a performance optimization.
Key rollover process: ZSK rollover (pre-publish method): 1. Publish new ZSK alongside old ZSK (both in DNSKEY RRset). 2. Wait for old DNSKEY TTL to expire from all caches. 3. Sign all RRsets with new ZSK. 4. Remove old ZSK from zone.
KSK rollover: Same as ZSK but requires DS record update in parent zone, which requires coordination with the registrar.
Wire format fields
| Field | Description |
|---|---|
| Flags | 16-bit flags. Bit 7 (Zone Key flag, value 256) MUST be set for ZSK and KSK. Bit 15 (SEP, Secure Entry Point) is set for KSK (total value 257). Other bits reserved. |
| Protocol | Must be 3 (DNSSEC). Any other value is invalid. |
| Algorithm | 8-bit algorithm number from IANA registry. 13=ECDSAP256SHA256, 15=Ed25519, 8=RSASHA256. |
| Public Key | Variable-length base64-encoded public key material. Format depends on algorithm. |
Zone file example
; DNSKEY records for example.com ; ZSK (flags=256): signs A, MX, CNAME, etc. example.com. IN DNSKEY 256 3 13 ( mdsswUyr3DPW132mOi8V9xESWE8jTo0d... ) ; ECDSAP256SHA256 ZSK ; KSK (flags=257): signs DNSKEY RRset, hash published in .com zone as DS example.com. IN DNSKEY 257 3 13 ( mdsswUyr3DPW132mOi8V9xESWE8jTo0d... ) ; ECDSAP256SHA256 KSK ; Verify with: dig DNSKEY example.com +dnssec ; Check key tag: dnssec-keytag (part of BIND/LDNS tools)