# DNSKEY record

A DNSKEY record publishes one of a zone's DNSSEC public keys. Resolvers use them to check the signatures (RRSIG records) on every answer. Most zones have a key-signing key (KSK, flags 257) whose fingerprint goes to the parent as a DS record, and a zone-signing key (ZSK, flags 256) that signs everything else.

- Record type: DNSKEY
- Type number: 48
- Used for: DNSSEC
- How common: Common
- Defined in: RFC 4034

## Format

```
@ <ttl> IN DNSKEY <flags> 3 <algorithm> <base64 public key>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Flags | 257 key-signing key, 256 zone-signing key. | 256 or 257. |
| Protocol | Always 3. | `3` |
| Algorithm | The signing algorithm. | 13 (ECDSA P-256) is the recommended choice; 8 (RSA/SHA-256) and 15 (Ed25519) are also fine. 5 and 7 are retired. |
| Public key | The key, base64. | Base64. |

## Examples

### Key-signing key

```
@ 3600 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
```

Its hash is what you give the registrar as the DS record.

### Zone-signing key

```
@ 3600 IN DNSKEY 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
```

Signs the zone's other records.

## DNSSEC in one paragraph

DNSSEC signs a zone's records so resolvers can prove an answer really came from the domain's owner and wasn't changed. Your DNS host signs the zone and publishes the keys (DNSKEY); the parent zone, such as .com, publishes a fingerprint of your key (DS), which you set at your registrar. That links your zone into a chain of trust that starts at the root.

## TTL

3600 to 86400. Your DNS host manages it.

## Common mistakes

- Moving to a new DNS host with different keys while the old DS is still at the registrar: validating resolvers (about a third of the internet) can't resolve the domain at all.
- Rolling the KSK without updating the DS at the registrar.

## At your DNS host

- Cloudflare, Route 53 and most hosts generate and publish DNSKEYs when you turn DNSSEC on; you then add the DS at your registrar.

## Questions

### Do I have to create DNSKEY records myself?

No. Turning DNSSEC on at your DNS host creates them. Your only manual step is adding the DS record at the registrar, and some registrars and hosts do even that automatically.

## Related

- [DS record](https://lemon.domains/dns-records/ds.md)
- [RRSIG record](https://lemon.domains/dns-records/rrsig.md)
- [CDS record](https://lemon.domains/dns-records/cds.md)
- [CDNSKEY record](https://lemon.domains/dns-records/cdnskey.md)
- [NSEC record](https://lemon.domains/dns-records/nsec.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/dnskey