DNSKEY Lookup
View the DNSKEY records of a signed zone: the key-signing key (KSK) and zone-signing key (ZSK) with their algorithm and flags.
- Runs on our servers
- Free to use
About this tool
DNSKEY records publish the public keys a signed zone uses. This lookup lists them with flags, protocol, algorithm and key material so you can identify the KSK and ZSK, check the algorithm in use and compare the KSK with the DS record held at the registrar when validation problems appear.
Together with the DNSSEC Lookup (signatures) and the DNSSEC Verifier (chain validation) it covers everything needed to debug DNSSEC.
How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example example.com. Use Ctrl + V to paste.
- 02
Press "Lookup DNSKEY records"
Press "Lookup DNSKEY records" or Ctrl + Enter. It takes a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
Live answer
The query is sent to a public resolver from our servers, so you see the records the world sees, not a cached copy from your ISP.
Parsed and raw
Records are listed in a clean table and the full dig output is available below it, with an option to copy all to clipboard.
TTL included
Each record shows its time-to-live (TTL), so you know how long DNS caches may keep the old value before refreshing it.
Frequently asked questions
KSK vs ZSK?
Flags 257 mark the key-signing key, whose hash is published as a DS record in the parent zone; flags 256 mark zone-signing keys that sign the actual records. Separating them lets you roll the ZSK without touching the registrar.
What is the algorithm number?
The DNSSEC algorithm identifies the cryptographic method used for signing: 8 is RSA/SHA-256, 13 is ECDSA P-256 (a widely supported modern choice), and 15 is Ed25519.
How do I get the DS record?
It is derived from the KSK (a hash of the key). Your DNS provider usually shows it; the DNSSEC Verifier confirms it matches what the registry publishes at the parent zone.