CERT Record Look Up
Related tools
What this is
CERT records can store certificates (X.509, PGP) directly in DNS. They are rare; DANE/TLSA and SMIMEA have superseded most of their intended uses.
How to read your result
No CERT records is the norm and never a problem. If one exists, someone put it there deliberately — typically for S/MIME or a legacy PKI integration.
Common problems and how to fix them
Stale CERT record from a retired system
How it shows up: Nothing visibly breaks, but the record advertises an old certificate — confusing audits, and misleading any system that still honors it.
How to fix it: If you cannot identify what consumes the record, treat it as removable: delete it and monitor. Keep DNS free of leftovers from decommissioned systems.
Related reading
No article on this topic yet.
Other articles →Frequently asked questions
- What is a CERT record?
- A CERT record (defined in RFC 4398) is a DNS record that stores a certificate or related revocation information directly in the zone. Common types include PKIX (X.509), PGP, SPKI and URI, letting a domain publish keys or certificates that clients can retrieve via DNS.
- How do I use this tool?
- Enter a domain name and the tool queries its CERT records server-side and displays each one in readable form. It shows the certificate type, the key tag, the algorithm and the certificate data, so you can see what is published without decoding it by hand.
- Why do CERT records matter?
- They let applications distribute certificates and public keys through DNS instead of a separate directory or web server, which can simplify key lookup for protocols like S/MIME or IPSEC. In practice they are niche, so finding one usually means a specific application was configured to rely on it.
- How do I read the result?
- Each entry begins with a certificate type (numeric or a mnemonic like PKIX, SPKI, PGP, URI), followed by a key tag, an algorithm number, and the base64-encoded certificate or key material. The type tells you what kind of object is stored and how a client is expected to use it.
- What is a common gotcha with CERT records?
- CERT records are rarely deployed, so an empty result is normal and does not indicate a problem for most domains. The stored data can also be large, which may lead to truncated or fragmented DNS responses, so the record needs a resolver and transport that handle bigger answers.