CERT Lookup
Query CERT records to retrieve certificate information stored in DNS
This page provides original, human-reviewed information about SSL/TLS certificate inspection, explaining certificate chains, validity periods, SANs, and what expired or mismatched certificates mean for SMTP and HTTPS.
CERT (Certificate) records are DNS resource records that store certificates and related cryptographic information in the Domain Name System. They enable the distribution of certificates through DNS infrastructure, providing an alternative method for certificate discovery and validation.
Key Components:
- Type:Specifies the certificate format (1 for PKIX, 2 for SPKI, 3 for PGP, etc.)
- Key Tag:A short numeric value that identifies the certificate
- Algorithm:The cryptographic algorithm used (RSA, ECDSA, etc.)
- Certificate:The actual certificate data in binary format
How CERT Records Work:
- Applications query DNS for CERT records of a specific domain
- DNS server returns available certificate information
- Client validates the certificate using standard PKI procedures
- Certificate can be used for encryption, authentication, or digital signatures
Basic CERT Record Configuration:
Certificate Types:
Type 1 - PKIX (X.509)
Standard X.509 certificates for TLS/SSL
Type 2 - SPKI
Simple Public Key Infrastructure certificates
Type 3 - PGP
PGP public keys for email encryption
No CERT Records Found
The domain has no CERT records configured in DNS.
Solution: Add CERT records to your DNS zone file or DNS management interface.
Invalid Certificate Format
The certificate data is not properly base64 encoded or is corrupted.
Solution: Verify certificate encoding and ensure proper base64 format.
Key Tag Mismatch
The key tag in the CERT record doesn't match the actual certificate.
Solution: Recalculate the key tag using the certificate's public key.
Certificate Expiration
The certificate stored in the CERT record has expired.
Solution: Update the CERT record with a new, valid certificate.
DNS Propagation Delays
CERT record changes may take time to propagate across DNS servers.
Solution: Wait 24-48 hours for full propagation or use lower TTL values.
Are CERT records widely supported?
CERT records are defined in RFC 4398 but are not widely implemented by applications. Most systems still rely on traditional certificate distribution methods like TLS handshakes or certificate stores.
How do CERT records differ from TLSA records?
TLSA records (RFC 6698) are used for DNS-Based Authentication of Named Entities (DANE) and specify certificate constraints, while CERT records store the actual certificate data. TLSA records are more commonly used for TLS certificate validation.
Can I store multiple certificates in CERT records?
Yes, you can have multiple CERT records for the same domain, each containing different certificates for different purposes (e.g., TLS, email encryption, code signing).
What's the maximum size for a CERT record?
CERT records are limited by DNS message size constraints. For UDP, this is typically 512 bytes, but EDNS0 can extend this. Large certificates may require TCP or should be referenced rather than embedded.
How do I calculate the key tag for a certificate?
The key tag is calculated using a specific algorithm based on the certificate's public key. For RSA keys, it's typically the last 16 bits of the key modulus. Tools like OpenSSL can help calculate this value.
Should I use CERT records for production systems?
CERT records are primarily experimental and not widely supported by applications. For production systems, consider using established certificate distribution methods and TLSA records for certificate validation instead.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.