Provide DNSKEY Information When Your Registrar Requests Flags, Protocol, Algorithm, and Public Key

Overview

If your registrar requests Flags, Protocol, Algorithm, and Public Key for DNSSEC, retrieve these values from your domain’s DNSKEY record.

A DNSKEY record contains a public key used to verify DNSSEC signatures. The fields requested in this article are DNSKEY fields. A Delegation Signer (DS) record uses a different set of fields: Key Tag, Algorithm, Digest Type, and Digest.

When to Use This Article

Use these steps when your registrar specifically requests Flags, Protocol, Algorithm, and Public Key.

If your registrar requests DS record fields, see What Information do I Need to Provide to My Registrar to Publish a DS Record .

Before You Begin

• Confirm that DNSSEC is enabled for your UltraDNS zone.
• Have access to the dig command.
• Identify an UltraDNS authoritative name server for your domain.
• Confirm which fields your registrar requires.

Steps

1. Query your domain’s DNSKEY records using an UltraDNS authoritative name server:

   dig @AUTHORITATIVE_NAME_SERVER YOUR_DOMAIN DNSKEY +norecurse

   Replace AUTHORITATIVE_NAME_SERVER with your domain’s authoritative name server and YOUR_DOMAIN with your domain name.

   The original article used this example:

   dig @pdns1.ultradns.net cst-lbproducts.com DNSKEY +norecurse

2. In the ANSWER SECTION, locate the DNSKEY record whose first value after DNSKEY is 257. This is the Key Signing Key (KSK) record identified in the supplied example.

   The following record comes from the original article’s historical output. It is an example, not a current lookup:

   cst-lbproducts.com. 60 IN DNSKEY 257 3 13 QTgbAhbIfKILgBaw1U2VCvcAVN9u4dFyTtAZQ0miPC1eqUyJEPta/FJNo4ZonLBViqf8r3DfOdkKDM0lLx8v7w==

3. Read the four fields after DNSKEY in this order:

   • Flags: 257 in this example.
   • Protocol: 3.
   • Algorithm: 13 in this example, meaning ECDSA Curve P-256 with SHA-256.
   • Public Key: The complete text after the algorithm value.

   The public key in this example is:

   QTgbAhbIfKILgBaw1U2VCvcAVN9u4dFyTtAZQ0miPC1eqUyJEPta/FJNo4ZonLBViqf8r3DfOdkKDM0lLx8v7w==

4. Provide the registrar with the four values from your domain’s current DNSKEY response.

   If the public key appears across multiple lines or in separate text groups, combine the complete key into one continuous string. Preserve every character, including any trailing = characters.

Expected Outcome

You have identified the Flags, Protocol, Algorithm, and Public Key values from your domain’s DNSKEY record and provided those values to your registrar.

Compare the submitted values with the DNSKEY response to check for copying errors. Ask the registrar to confirm acceptance and completion of the requested DNSSEC update. Retrieving or submitting these values alone does not confirm that the parent DS record has been published or that DNSSEC validation succeeds.

Common Issues

• No DNSKEY record with Flags 257 is returned: Confirm the queried domain, authoritative name server, and DNSSEC status. If you still cannot identify the required record, provide UltraDNS Support with the exact command and complete response.
• More than one DNSKEY record has Flags 257: This article does not establish which key to submit. Contact UltraDNS Support to confirm the appropriate key before changing the registrar’s DNSSEC configuration.
• The registrar rejects the values: Request the exact required field names and rejection message. Confirm whether the registrar requires DNSKEY fields or DS record fields before submitting another update.

Important Notes

• Use your domain’s current response. Do not submit the example domain’s public key.
• Copy the algorithm value returned for your domain. The example value 13 is not an instruction to change your domain’s algorithm.
• A request for DNSKEY fields does not establish that the registrar does not support DS records.

Related Articles

• What Information do I Need to Provide to My Registrar to Publish a DS Record