DNSKEY lookup
List the public keys a zone is signed with, and see which one is the key-signing key.
What DNSKEY records are
A DNSKEY record publishes a public key that is used to check the DNSSEC signatures on a zone's records. Each signed answer carries an RRSIG signature. A validating resolver fetches the matching DNSKEY from the zone and uses it to check that signature. A signed zone publishes one key or two, and more during a rollover, when keys are being replaced.
This lookup shows the zone's own side of DNSSEC. The parent's side is the DS record. A working setup has both, and the DS fingerprint matches one of the keys you see here.
How to read a DNSKEY
A record looks like 257 3 13 <base64 public key>. The four parts are the flags, the protocol (always 3), the algorithm number and the public key in base64.
| Flags | Role | What it does |
|---|---|---|
257 | Key-signing key (KSK) | Signs the DNSKEY set. A hash of it is what you give your registrar as the DS. |
256 | Zone-signing key (ZSK) | Signs all the other records in the zone. |
A single key (256 or 257) | Combined signing key (CSK) | Some providers use one key for both jobs. |
- Find the key-signing keyLook for flags
257. This is the key the parent's DS record should refer to. - Check the algorithmAlgorithms 13 (ECDSA P-256) and 15 (Ed25519) are modern and compact. Algorithm 8 (RSA/SHA-256) is still common. Algorithms 5 and 7, which use SHA-1, are discouraged.
- Match it with the DSCompare the key tag and algorithm from the DS lookup with a key here. They must correspond, or validators will fail the zone.
What a healthy result looks like
- At least one 257 key whose digest matches a DS in the parent, unless the zone is deliberately not anchored.
- A modern algorithm. RFC 8624 recommends ECDSA P-256, Ed25519 and RSA/SHA-256 for signing.
- Two keys during a rollover. The new and the old key sit side by side for a while, so cached signatures keep validating.
- Sensible key sizes. RSA keys of 2048 bits are typical for a KSK. Elliptic-curve keys are far smaller.
- The same keys on every nameserver. If they differ, signing is out of sync between providers.
Common problems
- No DNSKEY comes back. The zone is not signed, or a resolver or firewall on the way dropped the answer. Ask the authoritative servers to be sure.
- A DS exists but there is no DNSKEY. Validators will fail the domain. Turn signing back on at the DNS host, or remove the DS at the registrar.
- Keys differ between nameservers. Likely during a provider migration, or with two signing providers that are not coordinated.
- Expired signatures. If signing stops, the RRSIGs expire and validators begin to fail, even though the keys are correct. Check that signing is active at your DNS host.
- Key rollover mistakes. Removing the old key before caches have seen the new one breaks validation. Follow the pre-publish or double-signature procedures in RFC 6781 and RFC 7583.
How the lookup works and the standards
LookupOwl asks for type DNSKEY (code 48) with the DNSSEC OK bit set, so signatures are included, and shows each key with its role, algorithm and computed key tag. DNSKEY is defined in RFC 4034, with the key tag calculation in its Appendix B. Algorithm guidance is in RFC 8624, rollover practice in RFC 6781 and RFC 7583, and an overall operational summary in RFC 9364.
dig example.com DNSKEY +multi
dig +dnssec +short example.com DNSKEYQuestions people ask
What is a DNSKEY record?
A DNSKEY record is a DNS record that holds a public key. Resolvers use it to check the digital signatures on a signed zone's records, so it is a core part of DNSSEC. The matching private key stays with the signer and never appears in DNS. A zone can publish several DNSKEY records at the same time.
What is the difference between a KSK and a ZSK?
The key-signing key (flags 257) signs the key set, and the DS record at the parent refers to it. The zone-signing key (flags 256) signs the ordinary records. Splitting the jobs lets you replace the ZSK often without touching your registrar. Some providers use one combined key for both jobs.
How do I check that my DNSKEY matches my DS?
Compare the key tag and algorithm, then compute the DS digest from the DNSKEY with a tool such as dnssec-dsfromkey. If the values match the DS at the registry, the chain is intact. The DS lookup shows what the registry publishes, so you can compare the two side by side.
Which DNSSEC algorithm should I use?
Use ECDSA P-256 (13) or Ed25519 (15) for new zones. They have small keys, are fast and are widely supported. RSA/SHA-256 (8) is a safe fallback when a provider or registry does not support them yet. Avoid algorithms 5 and 7, which depend on SHA-1.
Is DNSSEC the same as HTTPS?
No, they protect different steps. DNSSEC proves that a DNS answer is genuine, so you are sent to the right address. HTTPS encrypts the connection to the website and proves the server's identity. Using both is stronger than either alone, but neither replaces the other.
Why do some domains show no DNSKEY?
Most likely because the zone is not signed. DNSSEC is optional, and adoption varies widely between extensions and DNS hosts. A lookup can also come back empty if a resolver or firewall on the way drops DNSSEC data. Choose the authoritative servers under More options before you decide it is unsigned.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dns_lookup. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dns-lookup?q=cloudflare.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp