Sign inMonitor a domain
DNSKEY · type 48

A zone’s public DNSSEC signing keys.

Last updated 5 Oct 2026 from the IANA RR TYPE registry

Short answer

DNSKEY records publish the public keys a signed zone uses. Typically there is a key-signing key (flags 257), whose hash is the DS at the parent, and a zone-signing key (flags 256) that signs the other records.

Type
DNSKEY
Code
48
Defined in
RFC 4034
IANA description
DNSKEY
Field: Flags
256 zone-signing, 257 key-signing
Field: Protocol
Always 3
Field: Algorithm
e.g. 13
Field: Public key
Base64

How it works

Resolvers fetch them to check the RRSIG signatures on answers. Managed DNS hosts create and rotate these automatically; you rarely touch them yourself.

Example

example.com.  3600  IN  DNSKEY  257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d…

Example uses reserved documentation names and addresses (RFC 2606, RFC 5737, RFC 3849).

Common mistakes

  • Removing the key the parent’s DS points to before the DS is updated.

How to check yours

You can see a zone’s keys with a DNSKEY lookup; the key-signing key has flags 257 and its key tag should match the DS record at the parent. When a DNS host rolls keys automatically it publishes the new key before switching, so seeing two keys of the same kind for a while is normal.

Related record types

DSThe parent zone’s fingerprint of a signed child’s key (DNSSEC).

Sources

Sources

  1. IANA: Resource Record (RR) TYPEs registry · checked 5 Oct 2026
  2. RFC 4034 · checked 5 Oct 2026