HTTPfy

DNSKEY record

DNSKEY records at a zone apex publish the public keys used to verify the zone's DNSSEC signatures (RRSIG records).

type code 48 RFC 4034RFC 6605RFC 8080

Live DNSKEY records from real domains

Checked at via public DNS
cloudflare.comDNSKEY
cloudflare.com. 2049 IN DNSKEY 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWz JaOau8XNEZeqCYKD5ar0IRd8KqXXFJkq mVfRvMGPmM1x8fGAa2XhSA==
  ; ZSK (zone-signing key), ECDSAP256SHA256, 64-byte public key
cloudflare.com. 2049 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d xCjjnopKl+GqJxpVXckHAeF+KkxLbxIL fDLUT0rAK9iUzy1L53eKGQ==
  ; KSK (key-signing key), ECDSAP256SHA256, 64-byte public key
isc.orgDNSKEY
isc.org. 2072 IN DNSKEY 256 3 13 1CS+VQcRn4lGTK+b3wDjVO0hFDx4DV7s 3Q1Fwxuq9ahd255FRny4f4vdZOMMMxpb RH5Zhwoh/706IV0v9JwjlA==
  ; ZSK (zone-signing key), ECDSAP256SHA256, 64-byte public key
isc.org. 2072 IN DNSKEY 257 3 13 zEoOfseNFDM+E8spu7RR2Ar/GzFqAehe 4yapWLiv6McIUF6xmI5GcIQ3+uLAizS2 cNWHt6EArVj8ogjtrRXwfw==
  ; KSK (key-signing key), ECDSAP256SHA256, 64-byte public key
ietf.orgDNSKEY
ietf.org. 2542 IN DNSKEY 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWz JaOau8XNEZeqCYKD5ar0IRd8KqXXFJkq mVfRvMGPmM1x8fGAa2XhSA==
  ; ZSK (zone-signing key), ECDSAP256SHA256, 64-byte public key
ietf.org. 2542 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d xCjjnopKl+GqJxpVXckHAeF+KkxLbxIL fDLUT0rAK9iUzy1L53eKGQ==
  ; KSK (key-signing key), ECDSAP256SHA256, 64-byte public key
DNSSEC Inspector for isc.org →

What the DNSKEY record does

Most zones use two roles. The key-signing key (KSK, flags 257) signs only the DNSKEY set, and its hash is what the parent stores in the DS record. The zone-signing key (ZSK, flags 256) signs everything else. Splitting them lets the ZSK be rotated often without involving the registrar. Some operators use a single combined key for both roles.

Algorithm 13 (ECDSA P-256 with SHA-256) is now the most common, because its keys and signatures are much smaller than RSA's and responses stay under UDP size limits.

Zone-file syntax

example.com.  3600  IN  DNSKEY  257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
; flags protocol algorithm public-key

Wire format: RDATA is a 16-bit flags field, an 8-bit protocol (always 3), an 8-bit algorithm and the public key.

Fields

FieldMeaning
Flags256 = zone key (ZSK); 257 = zone key with the Secure Entry Point bit (KSK). 385/384 add the revoke bit (RFC 5011).
ProtocolAlways 3. Any other value makes the key invalid.
Algorithm8 RSASHA256, 13 ECDSAP256SHA256, 14 ECDSAP384SHA384, 15 Ed25519, 16 Ed448.
Public keyBase64 key material in the algorithm's format.

Common mistakes

  • Removing an old ZSK before signatures made with it have expired from caches.
  • A KSK rollover where the new DS was never submitted to the parent.
  • Large RSA key sets that push DNSKEY responses past 1232 bytes, causing fragmentation or TCP fallback.

Specification

  • RFC 4034: Resource Records for the DNS Security Extensions
  • RFC 6605: Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC
  • RFC 8080: Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC

Related record types

  • DS: the DNSSEC link from parent to child zone
  • RRSIG: the DNSSEC signature over an RRset
  • NSEC: authenticated denial of existence

All DNS record types