What is a DNSKEY record?

A DNSKEY record publishes the public keys a validating resolver uses to verify DNSSEC signatures (RRSIG records) for a zone. It contains a flags field, a fixed protocol value of 3, an algorithm number, and the encoded public key.

How do I use this tool?

Enter a domain name and run the lookup; the tool queries the domain's DNSKEY records server-side and lists each key with its flags, algorithm and key data. If no DNSKEY appears, the zone simply is not signed with DNSSEC.

Why does the DNSKEY record matter?

DNSKEY records are the foundation of DNSSEC, letting resolvers cryptographically confirm that DNS answers are authentic and unaltered. Without a valid DNSKEY, signatures cannot be checked and the zone gains no DNSSEC protection.

How do I read the result?

The flags field tells you the key type: 257 is a Key Signing Key (KSK) and 256 is a Zone Signing Key (ZSK). The algorithm number identifies the crypto used, such as 8 for RSA/SHA-256 or 13 for ECDSA P-256.

Why is a DNSKEY alone not enough for DNSSEC to work?

A DNSKEY is only trusted if the parent zone publishes a matching DS record that fingerprints your KSK, forming the chain of trust. A DNSKEY present without a corresponding DS at the registrar means validation still fails.

DNSKEY Record Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

DNSKEY records publish the public keys of a DNSSEC-signed zone. The Key Signing Key (flags 257) is anchored by the parent's DS record; Zone Signing Keys (flags 256) sign the zone's record sets.

How to read your result

A signed zone shows at least one KSK and typically one ZSK. No DNSKEY records simply means the zone is not signed. If keys exist, the crucial question is whether the parent's DS record matches the current KSK — run the DNSSEC status look up for the combined picture.

Common problems and how to fix them

Keys were rolled but the DS record still matches the old KSK

How it shows up: The domain suddenly fails to resolve on validating resolvers (SERVFAIL on 8.8.8.8 / 1.1.1.1) while appearing fine on non-validating ones.

How to fix it: Generate the DS for the current KSK and update it at the registrar immediately. During planned rollovers, publish old and new keys side by side and only retire the old key after the new DS has propagated.

DNSKEY present but zone was moved to a provider without DNSSEC

How it shows up: After a DNS migration the domain goes dark for many users; the old provider's keys no longer answer.

How to fix it: Before migrating a signed zone, either transfer the signing setup or remove the DS record at the registrar first, wait for it to expire from caches, then migrate and re-sign at the new provider.

Frequently asked questions

What is a DNSKEY record?: A DNSKEY record publishes the public keys a validating resolver uses to verify DNSSEC signatures (RRSIG records) for a zone. It contains a flags field, a fixed protocol value of 3, an algorithm number, and the encoded public key.
How do I use this tool?: Enter a domain name and run the lookup; the tool queries the domain's DNSKEY records server-side and lists each key with its flags, algorithm and key data. If no DNSKEY appears, the zone simply is not signed with DNSSEC.
Why does the DNSKEY record matter?: DNSKEY records are the foundation of DNSSEC, letting resolvers cryptographically confirm that DNS answers are authentic and unaltered. Without a valid DNSKEY, signatures cannot be checked and the zone gains no DNSSEC protection.
How do I read the result?: The flags field tells you the key type: 257 is a Key Signing Key (KSK) and 256 is a Zone Signing Key (ZSK). The algorithm number identifies the crypto used, such as 8 for RSA/SHA-256 or 13 for ECDSA P-256.
Why is a DNSKEY alone not enough for DNSSEC to work?: A DNSKEY is only trusted if the parent zone publishes a matching DS record that fingerprints your KSK, forming the chain of trust. A DNSKEY present without a corresponding DS at the registrar means validation still fails.