# CERT record

A CERT record stores a certificate (X.509, PGP and others) or a certificate revocation list in DNS, or a URL pointing to one. It predates TLSA and OPENPGPKEY, which replaced it for most purposes.

- Record type: CERT
- Type number: 37
- Used for: Certificates and keys
- How common: Rare
- Defined in: RFC 4398

## Format

```
<name> <ttl> IN CERT <type> <key tag> <algorithm> <base64 data>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Type | What's stored: PKIX (X.509), PGP, IPKIX (URL of an X.509), IPGP (fingerprint and URL of a PGP key) and others. | A number or mnemonic. |
| Key tag | Identifies the key, or 0. | 0 to 65535. |
| Algorithm | The key algorithm, DNSSEC numbering, or 0. | 0 to 255. |
| Data | The certificate or CRL, base64. | Base64. |

## Examples

### A PGP key

```
smith 3600 IN CERT PGP 0 0 mQINBGJ1x8sBEAC7cQ6dZ8W9y5bO0nF2bFGtYqvH6h3k6R8u9vQ2s8b3p7Q=
```

Older GnuPG versions could look keys up this way.

## TTL

3600.

## Common mistakes

- Using CERT for website certificates. Browsers never read it.

## At your DNS host

- Cloudflare supports CERT.

## Questions

### Is CERT still used?

Rarely. TLSA, SMIMEA and OPENPGPKEY cover its uses with better support.

## Related

- [OPENPGPKEY record](https://lemon.domains/dns-records/openpgpkey.md)
- [SMIMEA record](https://lemon.domains/dns-records/smimea.md)
- [TLSA record](https://lemon.domains/dns-records/tlsa.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/cert