IPSECKEY Lookup
Query IPSECKEY records to retrieve IPsec gateway and public key information
Demo Data
Since IPSECKEY records are rare, you can view demo data to understand the query result format
This page provides original, human-reviewed information about IPSECKEY record lookups, explaining precedence, gateway types, and how IPSECKEY supports opportunistic IPsec key discovery.
IPSECKEY records are DNS records that store public keys and gateway information for IPsec connections. They enable automatic discovery of IPsec gateways and their associated public keys, facilitating secure communication between networks without manual configuration.
Key Components:
- Precedence:Priority value (0-255) where lower numbers indicate higher priority
- Gateway Type:Specifies the format of the gateway field (0=None, 1=IPv4, 2=IPv6, 3=Domain)
- Algorithm:Public key algorithm type (1=DSA, 2=RSA)
- Gateway:The IPsec gateway address or domain name
- Public Key:Base64-encoded public key for the gateway
How IPSECKEY Records Work:
- A client queries DNS for IPSECKEY records of the target domain
- The DNS server returns available IPSECKEY records with gateway and key information
- The client selects the highest priority (lowest precedence) available gateway
- IPsec connection is established using the provided public key for authentication
Basic IPSECKEY Record Configuration:
Record Format Explanation:
Precedence (10, 20)
Lower values have higher priority. Use different values for load balancing and failover.
Gateway Type (1=IPv4, 2=IPv6, 3=Domain)
Specifies the format of the gateway field that follows.
Algorithm (2=RSA)
Public key algorithm. RSA (2) is most commonly used.
No IPSECKEY Records Found
The domain has no IPSECKEY records configured. IPsec auto-discovery will not work.
Solution: Add IPSECKEY records to your DNS configuration.
Invalid Public Key Format
The public key is not properly base64-encoded or is corrupted.
Solution: Verify the public key encoding and regenerate if necessary.
Gateway Unreachable
The specified gateway address is not reachable or not responding.
Solution: Verify gateway connectivity and firewall rules.
Key Mismatch
The public key in DNS doesn't match the actual gateway's key.
Solution: Update the DNS record with the correct public key from your gateway.
How long does it take for IPSECKEY changes to propagate?
IPSECKEY record changes typically propagate within 24-48 hours, but can take up to 72 hours globally.The TTL value affects how quickly changes are recognized.
Can I have multiple IPSECKEY records for the same domain?
Yes, multiple IPSECKEY records provide redundancy and load balancing. Use different precedence valuesto control priority, with lower numbers having higher priority.
What happens if the gateway in an IPSECKEY record is unreachable?
IPsec clients will try the next highest priority gateway (higher precedence number) if available.If no gateways are reachable, the IPsec connection will fail.
Do I need IPSECKEY records for manual IPsec configuration?
No, IPSECKEY records are only needed for automatic IPsec gateway discovery. Manual configurationsdon't require DNS records, but IPSECKEY records can simplify management.
Which algorithms are supported in IPSECKEY records?
Currently, DSA (algorithm 1) and RSA (algorithm 2) are defined. RSA is more commonly usedand widely supported by IPsec implementations.
Can IPSECKEY records point to domain names instead of IP addresses?
Yes, when gateway type is 3, the gateway field contains a domain name instead of an IP address.This provides flexibility for dynamic IP environments.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.