HTTPfy

SSHFP record

An SSHFP record publishes the fingerprint of a server's SSH host key, so clients can verify the key on first connection instead of asking you to trust it blindly.

type code 44 RFC 4255RFC 6594RFC 7479

Live SSHFP records from real domains

Checked at via public DNS
freefall.freebsd.orgSSHFP
freefall.freebsd.org. 3600 IN SSHFP 1 1 b35c16d3da4b7fe15c15a55e7b6465231f9ede84
  ; RSA host key, SHA-1 fingerprint
freefall.freebsd.org. 3600 IN SSHFP 1 2 4b493272cccdd234c02ade8fafd4e772e5a3c775364b6bcaeee7a98b16e4ab04
  ; RSA host key, SHA-256 fingerprint
freefall.freebsd.org. 3600 IN SSHFP 3 1 e37999a583e73f49b22d19c306fb69d161d15988
  ; ECDSA host key, SHA-1 fingerprint
freefall.freebsd.org. 3600 IN SSHFP 3 2 a9b851fe028353393112f74db6c4e547bb8cea66e3f1443680c421a1b5eb420f
  ; ECDSA host key, SHA-256 fingerprint
freefall.freebsd.org. 3600 IN SSHFP 4 1 fe8be9cbc5a1d5110809e4b5267122f656171db8
  ; Ed25519 host key, SHA-1 fingerprint
freefall.freebsd.org. 3600 IN SSHFP 4 2 a09ec5297e544c158fe029dcb2bb1a21bd496df6edab328e3189e2de854b028d
  ; Ed25519 host key, SHA-256 fingerprint
ref14-amd64.freebsd.orgSSHFP
ref14-amd64.freebsd.org. 3600 IN SSHFP 1 1 ddc01978dd4193a674ce1230c6f6e4b064ee620b
  ; RSA host key, SHA-1 fingerprint
ref14-amd64.freebsd.org. 3600 IN SSHFP 1 2 ed063a2f21060cf46c5bfe4ac07d568cf86f3ad485fb2d4c9f10aa792cc8b949
  ; RSA host key, SHA-256 fingerprint
ref14-amd64.freebsd.org. 3600 IN SSHFP 3 1 1b9e1ff376231faf1727a25309bc7199ee22a7d0
  ; ECDSA host key, SHA-1 fingerprint
ref14-amd64.freebsd.org. 3600 IN SSHFP 3 2 0bda6cef34e81a37664f8cd801c14ceac23107f1f03be369112baba9df988796
  ; ECDSA host key, SHA-256 fingerprint
ref14-amd64.freebsd.org. 3600 IN SSHFP 4 1 9e507b40520b096163429d17552d9e12d10f93c3
  ; Ed25519 host key, SHA-1 fingerprint
ref14-amd64.freebsd.org. 3600 IN SSHFP 4 2 e89d465e42fa847dacc884ceb8e872dafd6ab35eabb88ab91ce25ccb249338a1
  ; Ed25519 host key, SHA-256 fingerprint
people.debian.orgSSHFP
people.debian.org. 3600 IN CNAME paradis.debian.org.
  ; points to paradis.debian.org
paradis.debian.org. 600 IN SSHFP 1 1 16655b389ae7a4f6dc96c663c408096727bf8a73
  ; RSA host key, SHA-1 fingerprint
paradis.debian.org. 600 IN SSHFP 1 2 11cbacbc685149822c4e24c79a634c2e5f16b02bd8edc404811a768154220a97
  ; RSA host key, SHA-256 fingerprint
paradis.debian.org. 600 IN SSHFP 4 1 b9906b7612cdd9127dadc078a22f6f42eb4a21fc
  ; Ed25519 host key, SHA-1 fingerprint
paradis.debian.org. 600 IN SSHFP 4 2 b259fde2fceb292b137b33ef4faa723bf1a56afbe5eff028f1671de3a05e45bd
  ; Ed25519 host key, SHA-256 fingerprint
DNSSEC Inspector for freebsd.org →

What the SSHFP record does

With VerifyHostKeyDNS yes in the OpenSSH client config, ssh looks up SSHFP for the host and, if the zone is DNSSEC-signed and the answer validated, accepts a matching key without the "authenticity of host can't be established" prompt. Without DNSSEC, OpenSSH only reports that a matching fingerprint was found and still asks.

Run ssh-keygen -r host.example.com on the server to print ready-made records for all of its host keys.

Zone-file syntax

host.example.com.  3600  IN  SSHFP  4 2 4b49...ab04
; algorithm fp-type fingerprint

Wire format: RDATA is an 8-bit algorithm, an 8-bit fingerprint type and the fingerprint bytes.

Fields

FieldMeaning
Algorithm1 RSA, 2 DSA, 3 ECDSA, 4 Ed25519, 6 Ed448.
Fingerprint type1 SHA-1, 2 SHA-256. Publish SHA-256.
FingerprintHex digest of the public host key blob.

Common mistakes

  • Reinstalling a server (new host keys) without updating SSHFP; clients then warn of a mismatch.
  • Publishing SSHFP in an unsigned zone and expecting the prompt to disappear.
  • Shipping only SHA-1 fingerprints.

Specification

  • RFC 4255: Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
  • RFC 6594: Use of the SHA-256 Algorithm with RSA, DSA, and ECDSA in SSHFP
  • RFC 7479: Using Ed25519 in SSHFP Resource Records

Related record types

  • TLSA: DANE certificate pinning in DNS
  • DNSKEY: the public keys that sign a zone
  • A: map a hostname to an IPv4 address

All DNS record types