OPENPGPKEY record
An OPENPGPKEY record publishes the OpenPGP public key for one email address, at a name derived from a hash of the mailbox, so senders can find it and encrypt to that person. GnuPG can look these up. The newer Web Key Directory (served over HTTPS) is more widely used.
| Record type | OPENPGPKEY |
|---|---|
| Type number | 61 |
| Used for | Certificates and keys |
| How common | Rare |
| Defined in | RFC 7929 |
Format
<sha256 of mailbox, 28 bytes hex>._openpgpkey.<domain> <ttl> IN OPENPGPKEY <base64 key>
| Field | What it means | Accepted values |
|---|---|---|
| Name | The first 28 bytes of the SHA-256 hash of the part before the @, in hex, then ._openpgpkey. | 56 hex characters. |
| Key | The binary OpenPGP public key, base64 encoded. | Base64. |
Check an OPENPGPKEY record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid OPENPGPKEY record.
| Part | What it means |
|---|---|
| Namec93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey | A name under the domain. In a dashboard for example.com, “c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey” means c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey.example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeOPENPGPKEY | OpenPGP public key for an email address. |
| Public keymDMEZHq0RRYJKwYBBAHaRw8BAQdA8V4J0SgtTQh3XmHlmKdS9fGv2Tg4CQ7mZ1rY9pJGmQ8= | The OpenPGP public key (binary, base64 encoded) for the mailbox this name stands for. |
Examples
One user's key
c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey 3600 IN OPENPGPKEY mDMEZHq0RRYJKwYBBAHaRw8BAQdA8V4J0SgtTQh3XmHlmKdS9fGv2Tg4CQ7mZ1rY9pJGmQ8=
gpg --export --export-options export-dane prints the record for you.
Look up OPENPGPKEY records
TTL
3600. How TTL works
Common mistakes
- Publishing the ASCII-armoured key (with BEGIN PGP lines) instead of base64 of the binary key.
At your DNS host
- Cloudflare supports OPENPGPKEY.
Questions
Is OPENPGPKEY the same as Web Key Directory?
No. Both publish OpenPGP keys for an address; WKD uses a file over HTTPS at your domain and is more widely supported.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free