DNSKEY record

A DNSKEY record publishes a public key used by DNSSEC to verify signed DNS data. The operator of a DNS zone, a part of DNS managed together, keeps the matching private key secret and uses it to create signatures. The public key can be shared so DNS lookup services that check DNSSEC can verify those signatures.

How does a DNSKEY help validate an answer?

A signed DNS zone publishes DNSKEY records and signatures over its record sets. A validating resolver checks a chain of signatures and links from a trusted starting point to decide whether the DNSKEY is authentic, then checks whether the signatures on requested data match. The parent zone's DS record can point to a child zone's DNSKEY by storing a digital summary of it, called a cryptographic digest.

For example, a DNS provider signs example.com records with a private key and publishes the related DNSKEY. The registrar or registry publishes the matching DS in the parent zone. If the key and DS align and the signatures verify, the resolver can accept the DNS answer as authenticated. A DNSKEY by itself does not encrypt queries or guarantee that a website's content is safe.

Is a DNSKEY the same as a DS record?

No. DNSKEY is the public key published in the zone it helps secure. DS is a reference stored by the parent zone that helps authenticate that key. Both participate in DNSSEC, but they appear at different levels of the DNS hierarchy.

Related terms

• DNSSEC — signs and validates DNS data
• DS record — parent-side reference to a DNSKEY
• DNS zone — publishes DNSKEY data
• DNS resolver — can validate signed responses