# OPENPGPKEY record

An OPENPGPKEY record publishes the OpenPGP public key for one email address, at a name derived from a hash of the mailbox, so senders can find it and encrypt to that person. GnuPG can look these up. The newer Web Key Directory (served over HTTPS) is more widely used.

- Record type: OPENPGPKEY
- Type number: 61
- Used for: Certificates and keys
- How common: Rare
- Defined in: RFC 7929

## Format

```
<sha256 of mailbox, 28 bytes hex>._openpgpkey.<domain> <ttl> IN OPENPGPKEY <base64 key>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Name | The first 28 bytes of the SHA-256 hash of the part before the @, in hex, then ._openpgpkey. | 56 hex characters. |
| Key | The binary OpenPGP public key, base64 encoded. | Base64. |

## Examples

### One user's key

```
c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey 3600 IN OPENPGPKEY mDMEZHq0RRYJKwYBBAHaRw8BAQdA8V4J0SgtTQh3XmHlmKdS9fGv2Tg4CQ7mZ1rY9pJGmQ8=
```

gpg --export --export-options export-dane prints the record for you.

## TTL

3600.

## Common mistakes

- Publishing the ASCII-armoured key (with BEGIN PGP lines) instead of base64 of the binary key.

## At your DNS host

- Cloudflare supports OPENPGPKEY.

## Questions

### Is OPENPGPKEY the same as Web Key Directory?

No. Both publish OpenPGP keys for an address; WKD uses a file over HTTPS at your domain and is more widely supported.

## Related

- [SMIMEA record](https://lemon.domains/dns-records/smimea.md)
- [CERT record](https://lemon.domains/dns-records/cert.md)
- [TXT record](https://lemon.domains/dns-records/txt.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/openpgpkey