SSHFP Record Security

The SSHFP record (SSH Fingerprint) publishes SSH host key fingerprints in DNS. When connecting via SSH, the client can verify that the server's key matches the fingerprint in DNS, protecting against man-in-the-middle attacks without manually verifying fingerprints.

What Is an SSHFP Record?

When you first connect to an SSH server, you typically see a prompt like:

The authenticity of host 'server.example.com' can't be established.
ED25519 key fingerprint is SHA256:abc123...
Are you sure you want to continue connecting (yes/no)?

SSHFP records let SSH clients automatically verify this fingerprint through DNS, eliminating the need for manual verification and reducing the risk of accepting a compromised key.

SSHFP Record Format

server.example.com.    3600    IN    SSHFP    4 2 abc123def456...

SSHFP Record Fields

Algorithm Types

Generating SSHFP Records

Use ssh-keygen to generate SSHFP records from your host keys:

# Generate SSHFP records for all host keys
ssh-keygen -r server.example.com

# Output example:
server.example.com IN SSHFP 1 1 abc...  # RSA SHA-1
server.example.com IN SSHFP 1 2 def...  # RSA SHA-256
server.example.com IN SSHFP 4 2 ghi...  # Ed25519 SHA-256

Configuring SSH Client

Enable SSHFP verification in ~/.ssh/config or /etc/ssh/ssh_config:

Host *
    VerifyHostKeyDNS yes       # Verify via SSHFP
    # Or use "ask" to prompt before accepting

With VerifyHostKeyDNS yes, SSH will automatically verify fingerprints via DNS.

SSHFP Best Practices

• Use DNSSEC — SSHFP is only secure with DNSSEC; without it, records can be spoofed.
• Use SHA-256 — Always include type 2 (SHA-256) fingerprints; SHA-1 is weak.
• Include all key types — Add SSHFP for each key type your server offers.
• Update after key rotation — When changing host keys, update SSHFP records.
• Keep RSA for compatibility — Include RSA SSHFP for older clients.

Example Complete SSHFP Setup

; SSHFP records for server.example.com
server.example.com.    SSHFP    1 2 a1b2c3d4e5f6...  ; RSA SHA-256
server.example.com.    SSHFP    3 2 f6e5d4c3b2a1...  ; ECDSA SHA-256
server.example.com.    SSHFP    4 2 123456789abc...  ; Ed25519 SHA-256

Troubleshooting SSHFP

Common issues and solutions:

• SSH not verifying — Enable VerifyHostKeyDNS in SSH config.
• "DNS lookup failed" — Check that SSHFP records exist and DNS is working.
• "DNSSEC validation failed" — Ensure zone is properly signed with DNSSEC.
• Fingerprint mismatch — Regenerate SSHFP records after key changes.
• "Insecure" warning — SSHFP requires DNSSEC for secure verification.

Related Record Types

• TLSA Record — TLS certificate verification
• DNSKEY Record — DNSSEC zone keys
• A Record — Server IP address
• AAAA Record — Server IPv6 address