Free DNSKEY Record Lookup & Checker

Quick select:
Your IP:
Check the DNS record Propagation in Multi-Region Check Multi-Region
Domain Type Primary NS Responsible Person Serial Refresh Retry Expire Minimum TTL
Name Server IP Address TTL
Domain Type TTL Record Value
Trace Result
Domain Type Record Status
Domain Type Record Status
Rate this result

Check live DNSKEY DNS records, TTL values, and trace the full root-to-authoritative resolution path.

DNSKEY Records Overview

What is a DNSKEY record?

A DNSKEY record holds the public key a zone uses to sign its DNSSEC records. Resolvers use it to verify the zone’s signatures (RRSIG records).

Why do you need a DNSKEY record?

DNSKEY records are the foundation of DNSSEC validation, proving that DNS answers for the zone are authentic and unaltered.

DNSKEY record structure

A DNSKEY record includes flags, protocol, algorithm, and the public key. Example: example.com. 3600 IN DNSKEY 257 3 13 mdsswUyr3DPW...

How to create a DNSKEY record?

DNSKEY records are generated and published automatically by your DNS provider when you enable DNSSEC. You generally do not create them by hand.

FAQs

A Key Signing Key (flags 257) signs the DNSKEY set and is anchored via the DS record; a Zone Signing Key (flags 256) signs the rest of the zone's records.

257 indicates a Key Signing Key (a Secure Entry Point); 256 indicates a Zone Signing Key.

The DS record in the parent zone is a hash of this zone's KSK DNSKEY, linking the parent's trust to this key.

ZSKs are commonly rotated every few months and KSKs less often (e.g. annually); most managed DNSSEC providers handle rotation automatically.

DNSKEY Record Troubleshooting & Common Fixes

Zone Signing Key (ZSK) rollover caused widespread resolver SERVFAIL

When rolling over your zone keys, if the old cryptographic signatures (RRSIG) expire or are revoked before intermediate recursive resolvers have updated their cached copy of the new DNSKEY, validation fails immediately across those caching resolvers.

How to fix: Always adopt a strict Pre-Publish or Double-Signature rollover strategy. Publish the new DNSKEY in the zone at least one full TTL duration before using it to sign zone records. Never purge the old DNSKEY until the TTL of all pre-existing RRSIG records has completely elapsed in recursive caches.

Missing Key Signing Key (KSK) or improper key flag assignment (256 vs 257)

A zone requires two key roles: a Key Signing Key with flag 257 (Secure Entry Point, which hashes to the parent DS record) and a Zone Signing Key with flag 256 (which signs zone records). If your zone only advertises a 256 key, validating resolvers fail to verify the trust anchor.

How to fix: Check your DNSKEY records with our lookup tool above. Ensure there is at least one DNSKEY with flag 257 whose Key Tag and digest match your parent registry's DS record. If managing your own BIND or PowerDNS keys, regenerate the KSK using the -f KSK or ksk flag.

UDP packet truncation and EDNS0 packet drops over 512 bytes

DNSKEY record sets with their accompanying RRSIG signatures routinely produce DNS response packets exceeding 1200 to 1400 bytes. If your upstream network firewall or router drops fragmented UDP packets or blocks DNS over TCP (port 53 TCP), resolvers will experience intermittent lookup timeouts.

How to fix: Ensure both UDP port 53 and TCP port 53 are fully open on your nameserver firewalls. Configure an EDNS0 buffer size of 1232 bytes (the DNS Flag Day standard) in your nameserver configuration to avoid IP fragmentation issues.

DNS Info extension for Chrome is now available

Install

Install