Skip to main content
protocols.pageprotocols.page
SSHFP

SSHFP Record

Active

The SSHFP (SSH Fingerprint) record stores a fingerprint of an SSH server's public key in DNS.

name TTL IN SSHFP algorithm fp-type fingerprint

In one line

The SSHFP (SSH Fingerprint) record stores a fingerprint of an SSH server's public key in DNS. When a client connects via SSH and DNSSEC is active, it can verify the server's host key against the SSHFP record – eliminating the 'authenticity of host can't be established' prompt and protecting against host key spoofing.

Description

SSHFP records store cryptographic fingerprints (SHA-1 or SHA-256 hashes) of SSH host public keys. When an SSH client with VerifyHostKeyDNS enabled connects to a host, it fetches the SSHFP record and compares it to the presented host key. This requires DNSSEC to be valid – an unvalidated SSHFP record provides no security guarantee. The record format encodes the algorithm (RSA=1, DSA=2, ECDSA=3, Ed25519=4) and hash type (SHA-1=1, SHA-256=2).

Examples

Ed25519 SHA-256 fingerprint
shell
example.com. 3600 IN SSHFP 4 2 a87f1b687ac0e57d2a081a2f282672334d90ed316d2b818ca9580ea384d92401
Generate SSHFP record
shell
ssh-keygen -r example.com
# Output: example.com IN SSHFP 4 1 ...
#         example.com IN SSHFP 4 2 ...
Verify via DNS
shell
dig example.com SSHFP +dnssec
Enable in SSH client
shell
# ~/.ssh/config
Host example.com
    VerifyHostKeyDNS yes

Related Record Types

DNSKEYTLSA

Specification

RFC 4255 – DNS SSHFP record specification →