SSHFP record
An SSHFP record publishes the fingerprint of a server's SSH host key, so SSH clients can verify the server on first connection instead of asking "Are you sure you want to continue connecting?". It needs DNSSEC to be trusted.
| Record type | SSHFP |
|---|---|
| Type number | 44 |
| Used for | Certificates and keys |
| How common | Specialist |
| Defined in | RFC 4255, RFC 6594, RFC 7479 |
Format
<host> <ttl> IN SSHFP <algorithm> <fingerprint type> <fingerprint>
| Field | What it means | Accepted values |
|---|---|---|
| Algorithm | The host key type. | 1 RSA, 2 DSA (retired), 3 ECDSA, 4 Ed25519, 6 Ed448. |
| Fingerprint type | The hash used. | 1 SHA-1 (retired), 2 SHA-256. |
| Fingerprint | The key's hash in hex. | 64 hex characters for SHA-256. |
Check an SSHFP record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid SSHFP record.
| Part | What it means |
|---|---|
| Nameserver1 | A name under the domain. In a dashboard for example.com, “server1” means server1.example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeSSHFP | SSH host key fingerprint. |
| Key algorithm4 | 4: Ed25519 host key. |
| Fingerprint type2 | 2: SHA-256, the one to use. |
| Fingerprintc6a3d7b4e4f8a2a3d3f3a6e9b5c1a7f0e2d4b6c8a0f2e4d6b8c0a2e4f6d8b0c2 | The host key's fingerprint. ssh-keygen -r <host> prints these records for you. |
Examples
Ed25519 host key
server1 3600 IN SSHFP 4 2 c6a3d7b4e4f8a2a3d3f3a6e9b5c1a7f0e2d4b6c8a0f2e4d6b8c0a2e4f6d8b0c2
Generate the real lines on the server with ssh-keygen -r server1.example.com.
Look up SSHFP records
TTL
3600. How TTL works
Common mistakes
- Publishing without DNSSEC, so clients can't trust it.
- Forgetting to update after reinstalling a server with new host keys.
At your DNS host
- Cloudflare, Route 53 and Google Cloud DNS support SSHFP. Clients need VerifyHostKeyDNS yes in their SSH config.
Questions
How do I create SSHFP records?
Run ssh-keygen -r yourhost.example.com on the server. It prints SSHFP lines for every host key; publish the SHA-256 (type 2) ones.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free