DNSKEY Lookup
Retrieve DNSKEY records for DNSSEC verification.
How to Use This Tool
- What to Enter
- Enter a domain to inspect its DNSKEY records and DNSSEC signing key configuration.
- What You Get
- Shows DNSKEY records with flags (KSK/ZSK), protocol, algorithm, public key data, key tag, and key length analysis.
How to Interpret Results
Flag 257 indicates a Key Signing Key (KSK) used in the chain of trust. Flag 256 indicates a Zone Signing Key (ZSK) used to sign actual records. Both should be present for a properly configured zone. Check that algorithms are current (13 or 8) and key lengths are sufficient.
Common Issues & Troubleshooting
Missing KSK (flag 257) breaks the DS chain of trust. Weak algorithms (RSA-512, SHA-1) are deprecated. Key rollover without proper timing can cause resolution failures during the transition period.