DNSKEY
acronymnetworkingcryptography
Stands for: DNS Public Key (record)
The DNS record that publishes a zone's public signing key.
A DNSKEY record (RFC 4034) holds the public key a resolver uses to verify a zone's DNSSEC signatures. Its hash is published as a DS record in the parent zone, linking the chain of trust.
A DNSKEY record holds the public key a resolver uses to verify a zone's signatures. Zones conventionally use two: a key-signing key that signs the key set and is referenced by the parent's DS record, and a zone-signing key that signs everything else.
The split exists to make rotation tractable. Changing the zone-signing key is a local operation; changing the key-signing key requires updating the DS record at the parent, which involves the registrar and is where most DNSSEC outages originate. A mismatch between the DS at the parent and the DNSKEY at the child breaks validation entirely, and because it fails closed the zone disappears for validating resolvers while appearing perfectly healthy to everyone else.
Also known as: dnskey