Every DNSKEY, RRSIG and DS record names its algorithm by number. RFC 8624 says which ones a signer should use today:
| Number | Name | For signing (RFC 8624) |
|---|---|---|
| 5 | RSASHA1 | Not recommended |
| 7 | RSASHA1-NSEC3-SHA1 | Not recommended |
| 8 | RSASHA256 | Must be supported |
| 10 | RSASHA512 | Not recommended |
| 13 | ECDSAP256SHA256 | Must be supported |
| 14 | ECDSAP384SHA384 | May be used |
| 15 | ED25519 | Recommended |
| 16 | ED448 | May be used |
Which one for a new zone?
13 (ECDSA P-256) is the usual choice: small keys and signatures, so answers fit in one UDP packet, and every validating resolver supports it. 8 (RSA/SHA-256) is still widespread and safe, but the records are much larger. 15 (Ed25519) is a good choice where your DNS host and registrar support it.
Avoid 5 and 7 (SHA-1). Some systems no longer accept SHA-1 signatures, so a zone signed with them can fail to validate.
Our checker shows the algorithm of the first DNSKEY it finds. Changing algorithm is a key rollover with extra steps: see KSK, ZSK and rollover.