CDNSKEY record
A CDNSKEY (child DNSKEY) record is the key-signing key your zone wants the parent to trust, published so the parent can build the DS itself. It's the DNSKEY counterpart of CDS. A CDNSKEY of 0 3 0 AA== asks for DNSSEC to be turned off.
| Record type | CDNSKEY |
|---|---|
| Type number | 60 |
| Used for | DNSSEC |
| How common | Specialist |
| Defined in | RFC 7344, RFC 8078 |
Format
@ <ttl> IN CDNSKEY <flags> 3 <algorithm> <public key>
| Field | What it means | Accepted values |
|---|---|---|
| Fields | Exactly as DNSKEY. | See DNSKEY. |
Check a CDNSKEY record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid CDNSKEY record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeCDNSKEY | Child's copy of DNSKEY, for automatic updates. |
| Flags257 | 257: key-signing key (KSK). Signs the DNSKEY set; its hash goes in the parent's DS. |
| Protocol3 | Always 3. |
| Algorithm13 | 13 is ECDSA P-256 with SHA-256. The recommended choice: small keys and signatures, supported everywhere. |
| Public keymdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT… | The public key, base64 encoded. |
Examples
The key to trust
@ 3600 IN CDNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
The parent hashes it into a DS.
Turn DNSSEC off
@ 3600 IN CDNSKEY 0 3 0 AA==
Asks the parent to remove the DS.
Look up CDNSKEY records
TTL
3600. How TTL works
Common mistakes
- Publishing CDS and CDNSKEY that disagree. Parents ignore both.
At your DNS host
- Published automatically by hosts that support automatic DS updates.
Questions
Do I need both CDS and CDNSKEY?
Some parents read one, some the other. Hosts usually publish both, and they must match.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free