DNSKEY Lookup
Query DNSKEY records to examine DNSSEC public keys and validation
Ready to Lookup DNSKEY Records
Enter a domain name above to query its DNSKEY records and examine DNSSEC configuration.
What you'll get:
- Public key information and algorithms
- Key Signing Keys (KSK) and Zone Signing Keys (ZSK)
- DNSSEC validation status
- Security recommendations
This page provides original, human-reviewed information about DNSKEY record lookups, explaining KSK versus ZSK roles, algorithm flags, and how DNSKEY pairs with DS records in the DNSSEC chain of trust.
DNSKEY (DNS Public Key) records contain public keys used in DNSSEC (DNS Security Extensions) to verify record authenticity.
Key Components:
- Flags:Indicates the key type (256 for ZSK, 257 for KSK)
- Protocol:Always 3 for DNSSEC
- Algorithm:Cryptographic algorithm used (RSA, ECDSA, etc.)
- Public Key:The actual cryptographic public key data
Key Types:
KSKKey Signing Key
Used to sign other DNSKEY records and establish trust with the parent zone
ZSKZone Signing Key
Used to sign all other records in the DNS zone
Step 1: Generate Keys
Step 2: Add DNSKEY Records to Zone
Step 3: Sign the Zone
Step 4: Submit DS Record to Parent
Generate a DS (Delegation Signer) record from your KSK and submit it to your parent zone (usually your domain registrar).
No DNSKEY Records Found
The domain does not have DNSSEC enabled or DNSKEY records are not published.
Solution: Enable DNSSEC and publish DNSKEY records in your DNS zone.
DNSSEC Validation Failures
DNS queries fail validation due to incorrect signatures or missing DS records.
Solution: Check DS record at parent zone and verify key signatures.
Key Rollover Issues
Problems during key rotation causing temporary validation failures.
Solution: Follow proper key rollover procedures and timing.
Algorithm Mismatch
Using deprecated or unsupported cryptographic algorithms.
Solution: Upgrade to modern algorithms like RSASHA256 or ECDSAP256SHA256.
How often should DNSKEY records be rotated?
ZSK (Zone Signing Keys) should be rotated every 1-3 months, while KSK (Key Signing Keys)can be rotated annually. The exact frequency depends on your security policy.
What's the difference between KSK and ZSK?
KSK (Key Signing Key) is used to sign DNSKEY records and establish trust with the parent zone.ZSK (Zone Signing Key) is used to sign all other records in the zone. This separation allowsfor more frequent ZSK rotation without affecting the parent zone relationship.
Which cryptographic algorithms are recommended?
Current recommendations include RSASHA256 (algorithm 8) for RSA keys, or ECDSAP256SHA256(algorithm 13) for ECDSA keys. Avoid deprecated algorithms like RSASHA1 or RSAMD5.
Can I have multiple DNSKEY records?
Yes, it's common and recommended to have multiple DNSKEY records. Typically, you'll haveat least one KSK and one ZSK, and may have additional keys during key rollover periods.
What happens if DNSSEC validation fails?
If DNSSEC validation fails, resolvers that enforce DNSSEC will return a SERVFAIL error,making your domain inaccessible to users. It's crucial to monitor DNSSEC status andhave proper key management procedures.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.