DNSKEY Lookup
Retrieve the DNSKEY records a domain publishes for DNSSEC - the public keys that sign its zone - with the flags, algorithm and key material decoded for you.
About DNSKEY Lookup
DNSSEC protects DNS answers from tampering by cryptographically signing them. To make those signatures verifiable, a signed zone publishes one or more DNSKEY records, each carrying a public key. There are normally two roles: the Key Signing Key (KSK), which has the flags value 257 and signs the DNSKEY set itself, and the Zone Signing Key (ZSK), flags 256, which signs the ordinary records in the zone (A, MX, TXT and so on). The protocol field is always 3, and the algorithm number identifies the signing scheme.
DNSKEY Lookup queries the domain from our European servers and returns each key as it appears on the wire: the flags, the fixed protocol value, the algorithm number and the base64-encoded public key, together with the record's TTL. Common algorithm numbers you will see are 8 (RSA/SHA-256), 13 (ECDSA Curve P-256 with SHA-256) and 15 (Ed25519); the last two produce much shorter keys than RSA while offering equivalent or better strength, which is why many modern zones are migrating to them.
Each DNSKEY has an associated key tag - a short checksum computed over the key - that the parent zone's DS record points to. Reading the DNSKEY set is therefore the second half of a DNSSEC chain-of-trust check: the DS record in the parent references a key by its tag and algorithm, and that key must be present here. If you are troubleshooting a broken chain, compare what this tool returns against the DS record shown by our DS Lookup tool.
Because the lookup runs on our own recursive infrastructure in the EU rather than through a third-party API, no request details are shared outside our servers and nothing about the domains you check is logged or sold.
How to use it
- 1Enter the domain whose DNSSEC keys you want to inspect, for example example.eu, and submit.
- 2Read the returned DNSKEY records: the first number is the flags field (257 marks a Key Signing Key, 256 a Zone Signing Key).
- 3Note the algorithm number (for example 8, 13 or 15) to see which cryptographic scheme signs the zone.
- 4Check the TTL to understand how long resolvers cache the key set, which matters when planning a key rollover.
- 5Cross-reference the key tag with the parent DS record using our DS Lookup tool to confirm the chain of trust is intact.
Common use cases
- -Confirm that a zone is actually DNSSEC-signed and that both a KSK and a ZSK are published.
- -Verify a key rollover: check that a new DNSKEY has appeared before retiring the old one.
- -Diagnose SERVFAIL responses from validating resolvers by inspecting the published key set.
- -Audit which DNSSEC algorithm a domain uses and spot legacy RSA/SHA-1 keys that should be upgraded.
- -Gather the key material needed to compute or verify a DS record when changing registrars.
Frequently asked questions
- What is a DNSKEY record?
- A DNSKEY record holds a public key used in DNSSEC to verify the signatures on a zone's DNS data. Resolvers fetch it to check that answers have not been altered in transit.
- What is the difference between a KSK and a ZSK?
- A Key Signing Key (flags 257) signs only the DNSKEY record set and is the key referenced by the parent's DS record. A Zone Signing Key (flags 256) signs the everyday records in the zone. Splitting the roles lets operators roll the ZSK frequently without touching the parent delegation.
- What do the numbers in a DNSKEY record mean?
- The four fields are flags, protocol, algorithm and key. Flags is 256 or 257, protocol is always 3, algorithm identifies the crypto scheme (for example 8 for RSA/SHA-256 or 13 for ECDSA P-256), and the final base64 blob is the public key itself.
- What is a key tag?
- A key tag is a 16-bit checksum derived from a DNSKEY, used to identify it quickly. The parent zone's DS record cites the key tag and algorithm so resolvers know which DNSKEY the DS is supposed to match.
- Does the tool prove DNSSEC is valid?
- It shows the DNSKEY records that a domain publishes. To confirm the full chain of trust, compare the key tag and algorithm here with the DS record in the parent zone, which our DS Lookup tool retrieves.