Glossary · DNS

DNSKEY Record

A DNSKEY record publishes a public key for a zone, which validating resolvers use to verify the DNSSEC signatures (RRSIG records) on that zone data.

Updated October 6, 2026

A DNSKEY record holds a zone's DNSSEC public key. Resolvers use it to check the RRSIG signatures attached to the zone's other record sets, proving the data was not altered. Each record carries flags, a protocol value of 3, an algorithm number and the key material.

Why it matters

Zones usually publish two kinds of keys. The zone-signing key (ZSK, flags 256) signs the ordinary records and can be rotated often. The key-signing key (KSK, flags 257) signs the DNSKEY set itself, and a hash of it appears in the parent as the DS record. Splitting the roles means routine ZSK rollovers do not require contacting the registrar. Key rollovers must be coordinated carefully, because an expired signature or mismatched key breaks validation.

Example

$ dig example.com DNSKEY +short
257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d...
256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWz...

Algorithm 13 is ECDSA P-256 with SHA-256.

Common mistakes

  • Assuming the DNSKEY alone makes a zone trusted. Without a matching DS in the parent, there is no chain of trust.
  • Rolling the KSK without updating the DS record.
  • Letting signatures expire because automatic re-signing stopped.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · DNSdig (Domain Information Groper)dig is a command-line DNS lookup tool that sends queries to a chosen resolver or nameserver and prints the full response, including flags, TTLs and sections.Glossary · DNSDNS Cache PoisoningDNS cache poisoning injects forged records into a resolver cache so users asking for a legitimate name are sent to an attacker-chosen IP address.Glossary · DNSDNS Resolver (Recursive Resolver)A DNS resolver is the server that looks up domain names for users by querying authoritative nameservers and caching the answers.Guide · Hosting & CDNHow to Change Nameservers Without Downtime (Step-by-Step)Switch DNS providers safely: copy the zone first, compare answers, handle DNSSEC and email records, change nameservers at the registrar, and verify with dig.8 min readGuide · DNS & DomainsDNS Records Cheat Sheet: A, AAAA, CNAME, MX, TXT, NS, CAAA practical DNS records reference: table of A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV and PTR with zone-file examples, dig commands and common mistakes.8 min readGuide · DNS & DomainsDNSSEC Explained: Chain of Trust, DS Records and Safe DeploymentUnderstand how DNSSEC signs DNS answers, what DNSKEY, DS and RRSIG records do, why misconfiguration causes SERVFAIL, and how to enable it or roll keys safely.9 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.