BRev DNSKEY record — DNSSEC public key
A DNSKEY record publishes a public key that resolvers use to verify the RRSIG signatures on a zone’s records. It is the point where DNSSEC stops being an idea and becomes something you can query: the key is in the zone, the signatures are beside every record set, and a validating resolver checks one against the other.
Zones normally publish two kinds, distinguished by the flags field. A Zone Signing Key (flags 256) signs the ordinary record sets and is rotated often, because it is used constantly. A Key Signing Key (flags 257, the SEP bit set) signs only the DNSKEY set, and it is the key whose digest goes into the parent zone as a DS record. That split exists so you can roll the busy key freely without touching the parent — changing the KSK means a registrar interaction, changing the ZSK does not.
The chain of trust runs downward: the root’s key is configured in the resolver, the root signs the DS for .com, .com signs the DS for your domain, and your DS matches your DNSKEY. Every link must hold. Break one — an expired signature, a DS that no longer matches, a key removed too early — and validating resolvers return SERVFAIL for the entire zone, which is a total outage for the roughly one in three users behind a validating resolver.
What a DNSKEY record looks like
Type 48 · DNSSEC public key. Zone-file form below — owner name, TTL, then the record and its RDATA.
| Name | TTL | Record | What it means |
|---|---|---|---|
| example.com. | 3600 | DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d… | Flags 257 = Key Signing Key. Algorithm 13 is ECDSA P-256 with SHA-256, the current default. |
| example.com. | 3600 | DNSKEY 256 3 13 oJB1W6WNGn2FrbqZQ4EQxjJ3F5jJt2mp… | Flags 256 = Zone Signing Key: signs the ordinary record sets and rotates frequently. |
| example.com. | 3600 | RRSIG DNSKEY 13 2 3600 20260815… example.com. … | The signature over the DNSKEY set, made with the KSK — what the parent’s DS ultimately anchors. |
The mistakes that break production
Rolling a key without overlapping the old one
Resolvers hold cached signatures and keys for their TTLs, so removing the old key immediately leaves cached signatures unverifiable — SERVFAIL until the caches clear. A key roll needs a pre-publish or double-signature period at least as long as the relevant TTLs. Automated signing (most managed DNS providers) handles this; hand-rolled setups are where it goes wrong.
Letting signatures expire
RRSIG records have an explicit expiry independent of TTL, and an expired signature is a validation failure — the zone goes dark for validating resolvers even though every record is present and correct. Monitor signature expiry as a separate alert from certificate expiry; the failure looks identical to “DNS is broken”.
Query a DNSKEY record now
The box below is seeded with cloudflare.com. Choose DNSKEY as the type and press Look up — the query goes from your browser straight to Cloudflare or Google over DNS-over-HTTPS, with no server of ours in the path.
DNS is the internet's address book: it turns a name like example.com into the addresses and service endpoints machines actually connect to. Every record has a type (what kind of fact it states) and a TTL (how long resolvers may cache it).
Record types
| Type | What it stores |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Canonical name (alias) |
| MX | Mail exchanger (priority target) |
| TXT | Text — SPF, verifications, DKIM, arbitrary data |
| NS | Authoritative nameservers |
| SOA | Start of authority (serial, refresh, retry, expire, minimum) |
| SRV | Service locator (priority weight port target) |
| CAA | Which CAs may issue certificates |
| PTR | Reverse DNS (IP → name) |
| DNSKEY | DNSSEC public key |
| DS | Delegation signer (DNSSEC chain of trust) |
| HTTPS | HTTPS service binding (ALPN, ECH, hints) |
| SVCB | General service binding |
| TLSA | DANE — pin certificates in DNS |
| NAPTR | Name authority pointer (SIP/ENUM) |
TTL & “propagation”
DNS changes don't “push” anywhere — resolvers simply keep the old answer until its TTL runs out, then fetch the new one. So a change “propagates” in at most the old record's TTL. Planning a change? Lower the TTL (e.g. to 300s) a day in advance, make the change, then raise it back. The compare card above shows whether major public caches have picked your change up yet.
FAQ
What is the difference between a KSK and a ZSK?
The Key Signing Key (flags 257) signs only the DNSKEY set and is the key the parent’s DS record points at. The Zone Signing Key (flags 256) signs everything else. Splitting them lets you rotate the busy key without involving the registrar.
What do the flags 256 and 257 mean?
256 is a zone key. 257 is a zone key with the Secure Entry Point bit set — conventionally the KSK, the one whose digest is published as a DS record in the parent.
Why did my domain go down after enabling DNSSEC?
Usually a broken chain: the DS record at the registrar does not match the published DNSKEY, or signatures expired. Validating resolvers answer SERVFAIL for the whole zone, so the domain is unreachable for a large share of users while looking fine to a non-validating lookup.