Skip to main content
protocols.pageprotocols.page
CERT

CERT Record

Active

The CERT record stores certificates and certificate revocation lists (CRLs) in DNS.

name TTL IN CERT type key-tag algorithm certificate

In one line

The CERT record stores certificates and certificate revocation lists (CRLs) in DNS. It supports multiple certificate formats: PKIX (X.509), SPKI, PGP, and IPKIX. CERT records can be used to publish PGP keys or X.509 certificates for S/MIME email encryption. In practice, CERT records have largely been superseded by DANE (TLSA) for TLS certificates and Web Key Directory (WKD) for OpenPGP.

Description

CERT records (RFC 4398) carry multiple types of certificate data in DNS. The type field determines the certificate format: 1=PKIX (X.509 as used in TLS), 2=SPKI, 3=PGP, 4=IPKIX (X.509 as URL), 5=ISPKI, 6=IPGP, 8=ACPKIX, 253=URI, 254=OID. The key tag and algorithm fields match the DNSKEY record convention. Usage is niche – most systems have moved to more specific record types (TLSA for TLS, WKD for PGP).

Examples

PKIX certificate
shell
user.example.com. 3600 IN CERT PKIX 0 0 <base64-der-encoded-x509>
PGP key
shell
user.example.com. 3600 IN CERT PGP 0 0 <base64-pgp-key>
Query CERT
shell
dig user.example.com CERT

Related Record Types

TLSADNSKEY

Specification

RFC 4398 – DNS CERT record specification →