IPSECKEY Record Look Up
Related tools
What this is
IPSECKEY records publish IPsec public keys and gateway information in DNS, enabling opportunistic IPsec — encrypted tunnels negotiated with no prior key exchange.
How to read your result
Absence is the norm. If present, the record only deserves trust when the zone is DNSSEC-signed — unsigned IPSECKEY records could be forged by an attacker to intercept tunnels.
Common problems and how to fix them
IPSECKEY published in an unsigned zone
How it shows up: Peers using the record are vulnerable: an attacker who can spoof DNS answers can substitute their own key and man-in-the-middle the "encrypted" tunnel.
How to fix it: Sign the zone with DNSSEC (and publish the DS record) before relying on IPSECKEY, or distribute keys out-of-band instead.
Related reading
No article on this topic yet.
Other articles →Frequently asked questions
- What is an IPSECKEY record?
- An IPSECKEY record is a DNS record type (defined in RFC 4025) that publishes a host's IPsec public key and gateway information. It lets systems discover the keying material needed to build an IPsec tunnel to that host directly from DNS.
- How do I use this IPSECKEY lookup tool?
- Enter a domain or hostname and run the lookup; the tool queries the IPSECKEY record for that name server-side and shows any results with their fields. Most names return nothing, since IPSECKEY records are rarely published.
- Why do IPSECKEY records matter?
- They let two hosts negotiate opportunistic IPsec encryption without manually pre-sharing keys, using DNS as the distribution channel. In practice they only add trustworthy security when the DNS answer is protected with DNSSEC.
- How do I read the fields in an IPSECKEY result?
- Each record shows a precedence (lower is preferred, like MX), a gateway type (none, IPv4, IPv6, or a domain name), an algorithm, and a Base64-encoded public key. Together they tell a client which gateway to tunnel to and which key to trust.
- Why does my IPSECKEY lookup return no records?
- An empty result almost always means the domain simply has no IPSECKEY record, which is normal because the type is very rarely deployed. This tool only reads what DNS publishes; it does not create records or set up IPsec tunnels.