Skip to content
Control Plane Labs
Search

CDNSKEY record

Publishes the child DNSKEY set that a parent can use to derive and maintain the delegation's DS records.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

example.com. 3600 IN CDNSKEY 257 3 13 BASE64...

Typical uses

  • Automating DNSSEC delegation changes from a child zone's published DNSKEY material
  • Letting a parent derive DS records instead of requiring an operator to copy a digest
  • Supporting key rollovers where the child and parent use a documented acceptance policy
  • Publishing CDNSKEY alongside CDS so two representations of the intended change can be checked

When it breaks, check

  • CDNSKEY is published at the child apex and uses the DNSKEY format, not the DS format
  • A parent consuming CDNSKEY must calculate the corresponding DS before comparing it with the current set
  • The record must be signed by a key represented in the current DNSKEY and DS sets
  • An empty or missing record does not authorize removal of the current delegation

What the CDNSKEY record does

CDNSKEY is the DNSKEY-shaped companion to CDS. Its RDATA describes the DNSKEY set the child wants reflected in the parent. A parent agent that consumes it computes the equivalent DS records, then compares that complete result with the existing delegation. When both CDS and CDNSKEY are present, the two requests must describe the same content.

This separation allows a DNS provider or registrar to perform the parent-side update without receiving credentials for the child zone. It also creates a strict continuity requirement: the current trust path must remain valid through the transition, and old keys must remain published until their cached and signed data has aged out. Inspect DS and DNSKEY when diagnosing the chain, then use the DNS lookup tool to compare authoritative answers.

Zone-file and wire format

CDNSKEY uses the DNSKEY presentation format: flags protocol algorithm public-key. Flags and protocol have the same meaning as DNSKEY, the algorithm identifies the DNSSEC algorithm, and the final field is the base64 public key. The parent derives the DS digest using its configured digest policy. A valid DNSKEY-shaped record is still only a request until a trusted parent validates and accepts it.

; illustrative CDNSKEY record (public key shortened)
example.com. 3600 IN CDNSKEY 257 3 13 AwEAA...base64-public-key...

Common uses

CDNSKEY fits managed DNSSEC rollovers, especially when the parent has automation that prefers keys over precomputed digests. Publish it with CDS when the parent supports both, and document which type the parent actually polls. It is not a replacement for ZONEMD zone-integrity checks or for the parent registrar’s account security.

Troubleshooting

Query CDNSKEY and DNSKEY from every authoritative child server and confirm that the answer is DNSSEC-valid. Check that the signing key is in the current trusted chain, then calculate the DS the parent should derive and compare it with the CDS result if both types are published. A parent that supports CDS but not CDNSKEY will ignore the latter by design.

During rotation, check SOA serials, RRSIG inception times, and TTLs before deleting a key. If the new key has not reached every authoritative server, stop the rollover rather than letting a parent observe different child states.

dig example.com CDNSKEY +dnssec +noall +answer
dig example.com DNSKEY +dnssec +noall +answer

# Compare the child authorities directly.
dig @ns1.example.net example.com CDNSKEY +norecurse +dnssec +noall +answer

The defining RFC

CDNSKEY is DNS type 60 and is defined by RFC 7344. The RFC gives CDNSKEY the DNSKEY wire and presentation format, requires child-apex publication, and requires a parent to validate continuity before applying the resulting DS change. See the IANA DNS Parameters registry for the assigned type and DNSKEY algorithm registries.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types