# CDNSKEY record

A CDNSKEY (child DNSKEY) record is the key-signing key your zone wants the parent to trust, published so the parent can build the DS itself. It's the DNSKEY counterpart of CDS. A CDNSKEY of 0 3 0 AA== asks for DNSSEC to be turned off.

- Record type: CDNSKEY
- Type number: 60
- Used for: DNSSEC
- How common: Specialist
- Defined in: RFC 7344, RFC 8078

## Format

```
@ <ttl> IN CDNSKEY <flags> 3 <algorithm> <public key>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Fields | Exactly as DNSKEY. | See [DNSKEY](https://lemon.domains/dns-records/dnskey). |

## Examples

### The key to trust

```
@ 3600 IN CDNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
```

The parent hashes it into a DS.

### Turn DNSSEC off

```
@ 3600 IN CDNSKEY 0 3 0 AA==
```

Asks the parent to remove the DS.

## TTL

3600.

## Common mistakes

- Publishing CDS and CDNSKEY that disagree. Parents ignore both.

## At your DNS host

- Published automatically by hosts that support automatic DS updates.

## Questions

### Do I need both CDS and CDNSKEY?

Some parents read one, some the other. Hosts usually publish both, and they must match.

## Related

- [CDS record](https://lemon.domains/dns-records/cds.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)
- [DS record](https://lemon.domains/dns-records/ds.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/cdnskey