# SSHFP record

An SSHFP record publishes the fingerprint of a server's SSH host key, so SSH clients can verify the server on first connection instead of asking "Are you sure you want to continue connecting?". It needs DNSSEC to be trusted.

- Record type: SSHFP
- Type number: 44
- Used for: Certificates and keys
- How common: Specialist
- Defined in: RFC 4255, RFC 6594, RFC 7479

## Format

```
<host> <ttl> IN SSHFP <algorithm> <fingerprint type> <fingerprint>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Algorithm | The host key type. | 1 RSA, 2 DSA (retired), 3 ECDSA, 4 Ed25519, 6 Ed448. |
| Fingerprint type | The hash used. | 1 SHA-1 (retired), 2 SHA-256. |
| Fingerprint | The key's hash in hex. | 64 hex characters for SHA-256. |

## Examples

### Ed25519 host key

```
server1 3600 IN SSHFP 4 2 c6a3d7b4e4f8a2a3d3f3a6e9b5c1a7f0e2d4b6c8a0f2e4d6b8c0a2e4f6d8b0c2
```

Generate the real lines on the server with ssh-keygen -r server1.example.com.

## TTL

3600.

## Common mistakes

- Publishing without DNSSEC, so clients can't trust it.
- Forgetting to update after reinstalling a server with new host keys.

## At your DNS host

- Cloudflare, Route 53 and Google Cloud DNS support SSHFP. Clients need VerifyHostKeyDNS yes in their SSH config.

## Questions

### How do I create SSHFP records?

Run ssh-keygen -r yourhost.example.com on the server. It prints SSHFP lines for every host key; publish the SHA-256 (type 2) ones.

## Related

- [TLSA record](https://lemon.domains/dns-records/tlsa.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)
- [DS record](https://lemon.domains/dns-records/ds.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/sshfp