Skip to main content
Book Consultation →
DNSSEC100% FreeInstant

DNSKEY Lookup: Check the DNSSEC Keys of a Domain

This free DNSKEY lookup shows the DNSSEC public keys published by a domain. See each key tag, whether it is a key signing key or zone signing key, its algorithm and whether a validating resolver trusted it.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is a DNSKEY Record?

A DNSKEY record publishes the public key used to check the digital signatures of a DNSSEC-signed zone. DNSSEC adds signatures to DNS answers so resolvers can tell whether the data was altered on its way. The DNSKEY records are where those signatures are verified.

If your domain uses DNSSEC, its zone publishes at least two keys. If it does not, there are no DNSKEY records. This lookup shows which keys exist and what each one is for.

How to Use This DNSKEY Lookup

  1. Enter the domain name, such as example.com. Use the zone apex, not a subdomain.
  2. Choose a resolver and press Lookup DNSKEY.
  3. Read the table of keys, then the checks underneath.

Reading the Key Table

ColumnMeaning
Key tagA short number that identifies the key. A DS record refers to it.
TypeKSK (flags 257) signs the key set. ZSK (flags 256) signs the other records.
ProtocolAlways 3 for DNSSEC.
AlgorithmThe signing method. 13 (ECDSA P-256) and 8 (RSA SHA-256) are the most common.
Public keyThe key itself in Base64 form.

The record format is defined in RFC 4034, which defines the DNSKEY and DS records.

Choosing a Signing Algorithm

  • 13, ECDSA P-256 with SHA-256. Small, fast and widely supported. A good default.
  • 8, RSA with SHA-256. Older but still very common.
  • 15, Ed25519. Modern and compact, with growing support.
  • 5 and 7, RSA with SHA-1. Deprecated. Plan to move away from them.

Common DNSSEC Problems

No DNSKEY records are shown

The domain may not use DNSSEC, or you may have entered a subdomain. DNSKEY records exist only at the top of a signed zone.

The resolver did not validate the answer

Some resolvers do not perform DNSSEC validation. Try another one from the list. The AD flag appears only when a validating resolver checked the signatures.

The keys do not match the parent

The DS record at your registrar must match your key signing key. Compare them with the delegation signer tool, which tests each DS record against the keys shown here.

Next Steps

Confirm that your name servers are consistent with the name server finder, and review the wider setup with the complete DNS health report. When DNSSEC is configured well, every step of the chain validates with no warnings.

When to Use a DNSKEY Lookup

A DNSKEY lookup is most useful at three moments: when you first enable DNSSEC, when you change DNS providers and when you rotate keys. Each of these changes the published keys, and a quick DNSKEY lookup confirms that the new ones are visible before you update the DS record at your registrar.

It also helps when a site suddenly fails validation. Seeing the live keys, their tags and their algorithm often explains the problem within seconds.

Frequently Asked Questions

A DNSKEY record holds a public key used to verify the digital signatures on a signed DNS zone. It is the base of DNSSEC.
The key signing key signs the set of keys and is referenced by the DS record at the parent. The zone signing key signs the rest of the zone and can change more often.
DNSSEC may simply not be enabled. DNSKEY records also exist only at the zone apex, so a subdomain will usually return nothing.
AD means authenticated data. A validating resolver sets it when it checked the DNSSEC signatures and found them valid.

Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.