DNSKEY

DNSKEY Record

Active

The DNSKEY record holds a public cryptographic key used in DNSSEC (DNS Security Extensions).

name TTL IN DNSKEY flags protocol algorithm public-key

In one line

The DNSKEY record holds a public cryptographic key used in DNSSEC (DNS Security Extensions). Resolvers use DNSKEY records to verify the digital signatures (RRSIG records) on other DNS records, ensuring the data hasn't been tampered with in transit. Each zone has a Zone Signing Key (ZSK) and optionally a Key Signing Key (KSK).

Description

DNSKEY is the cornerstone of DNSSEC. The zone publishes its public key in DNSKEY records. The corresponding private key is used offline to sign all other records, producing RRSIG records. There are two key types: ZSK (Zone Signing Key) signs the zone's resource records, and KSK (Key Signing Key) signs the DNSKEY RRset itself. The DS record in the parent zone links the chain of trust upward.

Examples

View zone keys

shell

dig example.com DNSKEY

Verify DNSSEC chain

shell

dig +dnssec +multiline example.com DNSKEY

Check DNSKEY flags

shell

# Flags: 256 = ZSK, 257 = KSK
# Protocol: always 3 (DNSSEC)
# Algorithm: 13 = ECDSA P-256/SHA-256 (recommended)

Related Record Types

DS TXT

Specification

RFC 4034 – DNS DNSKEY record specification →