DNSKEY record
A DNSKEY record publishes one of a zone's DNSSEC public keys. Resolvers use them to check the signatures (RRSIG records) on every answer. Most zones have a key-signing key (KSK, flags 257) whose fingerprint goes to the parent as a DS record, and a zone-signing key (ZSK, flags 256) that signs everything else.
| Record type | DNSKEY |
|---|---|
| Type number | 48 |
| Used for | DNSSEC |
| How common | Common |
| Defined in | RFC 4034 |
Format
@ <ttl> IN DNSKEY <flags> 3 <algorithm> <base64 public key>
| Field | What it means | Accepted values |
|---|---|---|
| Flags | 257 key-signing key, 256 zone-signing key. | 256 or 257. |
| Protocol | Always 3. | 3 |
| Algorithm | The signing algorithm. | 13 (ECDSA P-256) is the recommended choice; 8 (RSA/SHA-256) and 15 (Ed25519) are also fine. 5 and 7 are retired. |
| Public key | The key, base64. | Base64. |
Check a DNSKEY record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid DNSKEY record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeDNSKEY | DNSSEC public key. |
| Flags257 | 257: key-signing key (KSK). Signs the DNSKEY set; its hash goes in the parent's DS. |
| Protocol3 | Always 3. |
| Algorithm13 | 13 is ECDSA P-256 with SHA-256. The recommended choice: small keys and signatures, supported everywhere. |
| Public keymdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT… | The public key, base64 encoded. |
Examples
Key-signing key
@ 3600 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
Its hash is what you give the registrar as the DS record.
Zone-signing key
@ 3600 IN DNSKEY 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
Signs the zone's other records.
DNSSEC in one paragraph
DNSSEC signs a zone's records so resolvers can prove an answer really came from the domain's owner and wasn't changed. Your DNS host signs the zone and publishes the keys (DNSKEY); the parent zone, such as .com, publishes a fingerprint of your key (DS), which you set at your registrar. That links your zone into a chain of trust that starts at the root.
See it on a real domain
TTL
3600 to 86400. Your DNS host manages it. How TTL works
Common mistakes
- Moving to a new DNS host with different keys while the old DS is still at the registrar: validating resolvers (about a third of the internet) can't resolve the domain at all.
- Rolling the KSK without updating the DS at the registrar.
At your DNS host
- Cloudflare, Route 53 and most hosts generate and publish DNSKEYs when you turn DNSSEC on; you then add the DS at your registrar.
Questions
Do I have to create DNSKEY records myself?
No. Turning DNSSEC on at your DNS host creates them. Your only manual step is adding the DS record at the registrar, and some registrars and hosts do even that automatically.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free