Búsqueda DNSKEY
Recupera registros DNSKEY para verificación DNSSEC.
Cómo Usar Esta Herramienta
- Qué Ingresar
- Enter a domain to inspect its DNSKEY records and DNSSEC signing key configuration.
- Qué Obtienes
- Shows DNSKEY records with flags (KSK/ZSK), protocol, algorithm, public key data, key tag, and key length analysis.
Cómo Interpretar los Resultados
Flag 257 indicates a Key Signing Key (KSK) used in the chain of trust. Flag 256 indicates a Zone Signing Key (ZSK) used to sign actual records. Both should be present for a properly configured zone. Check that algorithms are current (13 or 8) and key lengths are sufficient.
Problemas Comunes y Soluciones
Missing KSK (flag 257) breaks the DS chain of trust. Weak algorithms (RSA-512, SHA-1) are deprecated. Key rollover without proper timing can cause resolution failures during the transition period.