A DNSKEY record publishes a public key of the zone, at the zone apex. Resolvers use it to check the RRSIG signatures on the zone's records. Defined in RFC 4034.
example.com. 3600 IN DNSKEY 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d…
│ │ │ └ public key (base64)
│ │ └ algorithm (13 = ECDSA P-256)
│ └ protocol, always 3
└ flags
Flags: 256 and 257
- 256: a zone key. Usually the ZSK (zone-signing key) that signs the records.
- 257: a zone key with the Secure Entry Point bit. Usually the KSK (key-signing key) that signs the DNSKEY set and that the parent's DS points at.
A zone can also use one key for both jobs, a CSK (combined signing key), with flags 257. That is simpler, and with ECDSA keys it is common. Read more in KSK, ZSK and rollover.
Key tag
Each key has a 16-bit key tag, computed from the record. RRSIG and DS records name the key by its tag, so a resolver can find the right key quickly.
Check it
dig DNSKEY example.com +multi # shows "; KSK; alg = ECDSAP256SHA256 ; key id = 36114"
Our checker counts DNSKEY records. No DNSKEY means the zone is not signed at all.