Skip to content
Control Plane Labs
Search

SSHFP record

Publishes an SSH host-key fingerprint in DNS so a client can compare the key it receives with an authenticated DNS answer.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

host.example.com. 3600 IN SSHFP 4 2 6B3A...

Typical uses

  • Publishing fingerprints for SSH hosts managed through a DNSSEC-signed zone
  • Giving fleet bootstrap and configuration management clients a second host-key verification source
  • Supporting planned host-key rotation by publishing the new fingerprint before changing the server
  • Documenting host-key algorithms and digest types alongside the host name

When it breaks, check

  • The algorithm number must match the SSH public-key algorithm received from the server
  • The fingerprint type must match the digest used to calculate the published value
  • A matching record is not a trust anchor unless the DNS answer is authenticated with DNSSEC or another trusted channel
  • Query the exact fully qualified host name; short-name search paths can produce an unexpected lookup

What the SSHFP record does

SSHFP binds an SSH host name to one or more public-key fingerprints. The record’s algorithm field identifies the SSH key family, while the fingerprint type identifies the digest used over the public-key blob. A client may keep several records during a planned rotation, allowing both the old and new key to be recognized for a controlled interval.

The security boundary is important: DNSSEC protects the integrity of the published record, not the original transfer of the fingerprint into the DNS zone. Operators should verify that transfer separately and configure the SSH client to require an authenticated answer before it treats a match as meaningful. For an ordinary DNS query, use the DNS lookup tool; for the broader DNSSEC chain, compare DS and DNSKEY records.

Zone-file and wire format

SSHFP RDATA is algorithm fingerprint-type fingerprint. The algorithm number identifies the SSH public-key algorithm. The fingerprint type selects the digest, and the final field is the digest in hexadecimal presentation. RFC 6594 defines fingerprint type 2 for SHA-256; use the type supported by the SSH client and publish a value calculated from the exact key blob received from the server.

; RSA key, SHA-256 fingerprint (illustrative digest)
host.example.com. 3600 IN SSHFP 1 2 6b3a...sha256-fingerprint...

Common uses

SSHFP fits managed infrastructure where host names are stable and the DNS zone is operated with DNSSEC. It can complement known-hosts files, provisioning systems, and a documented key-rotation runbook. It is not a generic certificate record: inspect HTTPS certificates with the TLS inspector, and use TLSA when the service’s protocol calls for TLS certificate association.

Troubleshooting

Start on the SSH server: record the public-key algorithm and calculate the fingerprint from the public-key blob, not from a copied display string. Query the exact host name with DNSSEC enabled, then check that the answer validates and that its algorithm and fingerprint type match the presented key. A mismatch can mean the server rotated early, the zone contains an old value, or the client queried a different name through a search path.

During rotation, publish the replacement before removing the old record and allow the relevant TTL and client caches to expire. Removing every record does not revoke a host key from clients that already pinned it locally; it only removes this DNS verification path.

dig host.example.com SSHFP +dnssec +noall +answer

# Ask the authoritative server while diagnosing a stale answer.
dig @ns1.example.net host.example.com SSHFP +norecurse +dnssec +noall +answer

The defining RFC

SSHFP is DNS type 44, defined by RFC 4255. The record’s algorithm and fingerprint fields describe the SSH key and digest, while RFC 6594 adds SHA-256 fingerprints. RFC 4255 says a client must not trust a fingerprint that was not authenticated through DNSSEC or another trusted channel. The IANA SSHFP registry records the assigned algorithm and fingerprint-type values.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types