What is the difference between a ZSK and KSK?

A Zone Signing Key (ZSK) is used to sign zone data like A or MX records, indicated by flag 256. A Key Signing Key (KSK) is used to sign the DNSKEY record itself, indicated by flag 257. This separation improves security and key management flexibility.

Why are DNSKEY records important for security?

DNSKEY records are essential for DNSSEC to function. They allow DNS resolvers to verify that DNS data has been signed and that signatures are valid. This prevents forged DNS records, protects against man-in-the-middle attacks, and maintains domain integrity across the DNS hierarchy.

April 18, 2026 DNSai Security

What Is a DNSKEY Record? The Cryptographic Core of DNSSEC

Q: What is a DNSKEY record?

A DNSKEY record stores a public cryptographic key in DNS. This key is used to verify RRSIG signatures, which confirm the authenticity of DNS records as part of DNSSEC (Domain Name System Security Extensions).

Q: How do I look up a DNSKEY record?

You can look up DNSKEY records using the dig command: 'dig +dnssec example.com DNSKEY'. If the domain uses DNSSEC, you will see one or more DNSKEY records including both a ZSK and a KSK. You can also use online tools like DNSai's DNSKEY lookup.

DNS is the backbone of the internet, but it was not designed with security in mind. That is where DNSSEC (Domain Name System Security Extensions) comes in, adding cryptographic protection to DNS queries and responses.

Look Up DNSKEY Records

Check DNSKEY records for any domain using our free DNS lookup tool.

Look Up DNSKEY Records →

At the heart of DNSSEC lies the DNSKEY record. This is the actual public key used to validate signed DNS data and prove that it has not been tampered with.

If you are working with DNS security or even just curious about how DNS authentication works, understanding DNSKEY records is a must.

What Is a DNSKEY?

A DNSKEY record stores a public cryptographic key in DNS. This key is used to verify RRSIG signatures, which in turn confirm the authenticity of DNS records.

DNSKEYs live in the authoritative DNS zone for a domain and can play one of two roles:

Zone Signing Key (ZSK): Used to sign zone data like A or MX records.
Key Signing Key (KSK): Used to sign the DNSKEY record itself.

This separation of duties improves security and makes key management more flexible.

What Does a DNSKEY Record Look Like?

Here is an example DNSKEY record:

example.com. IN DNSKEY 256 3 8 AwEAAcFv...

Let's break this down:

256 — Flags (256 means it is a ZSK, 257 means it is a KSK)
3 — Protocol (always 3 for DNSSEC)
8 — Algorithm (e.g., RSA/SHA-256)
The rest — The actual base64-encoded public key

Why DNSKEY Records Matter

Without DNSKEY records, DNSSEC cannot function. These keys are used by resolvers to check whether DNS data has been signed and whether the signature is valid. This helps:

Prevent forged DNS records
Protect against man-in-the-middle attacks
Maintain domain integrity across the DNS hierarchy

In short, DNSKEY is how DNS learns to trust itself.

How to Look Up a DNSKEY Record

You can check if a domain is publishing its DNSKEY using built-in tools on your computer. Follow the steps below based on your operating system:

Windows

1. Click the Start menu and type cmd or PowerShell.

2. Press Enter to open the Command Prompt or PowerShell.

3. Type the following command and press Enter:

nslookup -type=DNSKEY example.com

macOS

1. Open Finder, go to Applications > Utilities, then open Terminal.

2. Type the following command and press Return:

dig +dnssec example.com DNSKEY

Linux

1. Open your terminal. You can usually do this with Ctrl+Alt+T or by searching for "Terminal" in your application menu.

2. Type the following command and press Enter:

dig +dnssec example.com DNSKEY

If dig is not installed, you can add it with:

sudo apt install dnsutils

If the domain uses DNSSEC, you will see one or more DNSKEY records. These will typically include both a ZSK and a KSK.

Final Thoughts

The DNSKEY record is not something most users interact with directly, but it plays a critical role in modern DNS security. If you manage DNS zones and plan to implement DNSSEC, you will need to generate, publish, and maintain DNSKEYs as part of your signing process.

When used properly, DNSKEY records help secure your domain against a range of DNS-based attacks and bring cryptographic trust to one of the internet's most fundamental systems.