Busca DNSKEY
Recupere registros DNSKEY para verificação DNSSEC.
Como Usar Esta Ferramenta
- O Que Inserir
- Enter a domain to inspect its DNSKEY records and DNSSEC signing key configuration.
- O Que Você Obtém
- Shows DNSKEY records with flags (KSK/ZSK), protocol, algorithm, public key data, key tag, and key length analysis.
Como Interpretar os Resultados
Flag 257 indicates a Key Signing Key (KSK) used in the chain of trust. Flag 256 indicates a Zone Signing Key (ZSK) used to sign actual records. Both should be present for a properly configured zone. Check that algorithms are current (13 or 8) and key lengths are sufficient.
Problemas Comuns e Soluções
Missing KSK (flag 257) breaks the DS chain of trust. Weak algorithms (RSA-512, SHA-1) are deprecated. Key rollover without proper timing can cause resolution failures during the transition period.