A DNSKEY record holds a zone's DNSSEC public key. Resolvers use it to check the RRSIG signatures attached to the zone's other record sets, proving the data was not altered. Each record carries flags, a protocol value of 3, an algorithm number and the key material.
Why it matters
Zones usually publish two kinds of keys. The zone-signing key (ZSK, flags 256) signs the ordinary records and can be rotated often. The key-signing key (KSK, flags 257) signs the DNSKEY set itself, and a hash of it appears in the parent as the DS record. Splitting the roles means routine ZSK rollovers do not require contacting the registrar. Key rollovers must be coordinated carefully, because an expired signature or mismatched key breaks validation.
Example
$ dig example.com DNSKEY +short
257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d...
256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWz...Algorithm 13 is ECDSA P-256 with SHA-256.
Common mistakes
- Assuming the DNSKEY alone makes a zone trusted. Without a matching DS in the parent, there is no chain of trust.
- Rolling the KSK without updating the DS record.
- Letting signatures expire because automatic re-signing stopped.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.