CERT record
A CERT record stores a certificate (X.509, PGP and others) or a certificate revocation list in DNS, or a URL pointing to one. It predates TLSA and OPENPGPKEY, which replaced it for most purposes.
| Record type | CERT |
|---|---|
| Type number | 37 |
| Used for | Certificates and keys |
| How common | Rare |
| Defined in | RFC 4398 |
Format
<name> <ttl> IN CERT <type> <key tag> <algorithm> <base64 data>
| Field | What it means | Accepted values |
|---|---|---|
| Type | What's stored: PKIX (X.509), PGP, IPKIX (URL of an X.509), IPGP (fingerprint and URL of a PGP key) and others. | A number or mnemonic. |
| Key tag | Identifies the key, or 0. | 0 to 65535. |
| Algorithm | The key algorithm, DNSSEC numbering, or 0. | 0 to 255. |
| Data | The certificate or CRL, base64. | Base64. |
Check a CERT record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid CERT record.
| Part | What it means |
|---|---|
| Namesmith | A name under the domain. In a dashboard for example.com, “smith” means smith.example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeCERT | Certificate or certificate revocation list. |
| Certificate typePGP | PGP |
| Key tag0 | Identifies the key; 0 if not used. |
| Algorithm0 | The key's algorithm, using the DNSSEC numbers; 0 if not used. |
| CertificatemQINBGJ1x8sBEAC7cQ6dZ8W9y5bO0nF2bFGtYqvH6h3k6R8u9vQ2s8b3p7Q= | The certificate or certificate revocation list, base64 encoded. |
Examples
A PGP key
smith 3600 IN CERT PGP 0 0 mQINBGJ1x8sBEAC7cQ6dZ8W9y5bO0nF2bFGtYqvH6h3k6R8u9vQ2s8b3p7Q=
Older GnuPG versions could look keys up this way.
Look up CERT records
TTL
3600. How TTL works
Common mistakes
- Using CERT for website certificates. Browsers never read it.
At your DNS host
- Cloudflare supports CERT.
Questions
Is CERT still used?
Rarely. TLSA, SMIMEA and OPENPGPKEY cover its uses with better support.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free