DNSKEY Record DNSSEC

The DNSKEY record contains the public cryptographic keys used to verify DNSSEC signatures. It's a fundamental part of DNSSEC that allows resolvers to verify that DNS responses are authentic and haven't been tampered with.

What Is a DNSKEY Record?

DNSKEY records publish the public keys that correspond to the private keys used to sign DNS records. When a resolver receives a signed DNS response, it uses the DNSKEY to verify the signature.

DNSSEC typically uses two types of keys:

• Key Signing Key (KSK) — Signs the DNSKEY records themselves
• Zone Signing Key (ZSK) — Signs all other records in the zone

DNSKEY Record Format

example.com.    3600    IN    DNSKEY    257 3 13 mdsswUyr3DPW...base64key...

DNSKEY Record Fields

Key Types: KSK vs ZSK

Common DNSSEC Algorithms

DNSSEC Chain of Trust

DNSKEY records are part of the DNSSEC chain of trust:

1. Root zone — Contains DNSKEY for the root
2. TLD — DS record in root points to TLD's DNSKEY
3. Your domain — DS record in TLD points to your DNSKEY
4. Your records — RRSIG records signed by your ZSK

Related DNSSEC Records

• DS Record — Hash of DNSKEY in parent zone
• RRSIG Record — Signatures for DNS records
• NSEC Record — Proves record doesn't exist
• NSEC3 Record — Hashed denial of existence

DNSKEY Best Practices

• Use modern algorithms — Prefer ECDSA (13) or Ed25519 (15) over RSA.
• Separate KSK and ZSK — Allows independent rotation schedules.
• Plan key rollovers — Publish new keys before removing old ones.
• Monitor DNSSEC validity — Set up alerts for expiring signatures.
• Backup private keys securely — Loss of KSK requires DS update at parent.

Checking DNSKEY Records

# Query DNSKEY records
dig example.com DNSKEY

# With DNSSEC validation info
dig example.com DNSKEY +dnssec

# Check the trust chain
delv example.com

Troubleshooting DNSKEY

Common issues and solutions:

• SERVFAIL with DNSSEC — Signature validation failed; check RRSIG expiration.
• DS/DNSKEY mismatch — Update DS record at parent after key rollover.
• Algorithm mismatch — Ensure DS and DNSKEY use the same algorithm.
• Key tag collision — Rare but possible; regenerate key.

Related Record Types

• DS Record — DNSSEC delegation
• RRSIG Record — DNSSEC signatures
• NSEC Record — Denial of existence
• CDNSKEY Record — Automated DS updates