Search... ⌘ K
Get Started Contact Sales

SSHFP Record Reference

Last updated

An SSHFP (SSH Fingerprint) record publishes the fingerprint of an SSH server’s host key in DNS, so SSH clients can check the key before they connect. This reference covers the record’s format, the values DNSimple accepts, and how clients use it.

SSHFP record format

An SSHFP record has a type code of 44 and is defined in RFC 4255. The record’s data section has three parts:

<name> <TTL> IN SSHFP <algorithm> <fingerprint-type> <fingerprint>

  • algorithm: The public key algorithm. Values: 1 (RSA), 2 (DSA), 3 (ECDSA), 4 (Ed25519), and 6 (Ed448).
  • fingerprint-type: The hash used to generate the fingerprint. Values: 1 (SHA-1) and 2 (SHA-256).
  • fingerprint: The fingerprint of the public key, as a hexadecimal string. A SHA-1 fingerprint is 40 characters long, and a SHA-256 fingerprint is 64.

In the DNSimple record fields editor, an SSHFP record has these fields:

  • Name: The host name for the record, without the domain name. Leave it blank for the domain itself.
  • Algorithm: The algorithm of the public key. The list offers RSA, DSA, ECDSA, and Ed25519. To add an Ed448 (6) record, use the simple editor.
  • Fingerprint Type: SHA1 or SHA256.
  • Fingerprint: The public key fingerprint.
  • TTL (Refresh Rate): How long resolvers can cache the record.

DNSimple checks that the fingerprint is hexadecimal and that its length matches the fingerprint type. For more on the two editors, see DNSimple Record Editors: Simple vs. Field-Specific.

Example SSHFP record

A single SSH host can have several SSHFP records, one for each key algorithm and fingerprint type.

server.example.com. IN SSHFP 1 1 82f6f59c25f4c478cf39943343460395c2df11c8
server.example.com. IN SSHFP 4 2 24d27e907a972c72b22f98cb0422f7902d25081f964ce2a2202613d90236a29f

The first record is for an RSA key (1) with a SHA-1 fingerprint (1).
The second record is for an Ed25519 key (4) with a SHA-256 fingerprint (2).

How it is used

When an SSH client connects to a host, it can look up the host’s SSHFP records and compare them with the fingerprint of the key the server presents. In OpenSSH, this is the VerifyHostKeyDNS option, which is off by default.

OpenSSH trusts a matching fingerprint automatically only when the DNS answer is signed with DNSSEC. Without DNSSEC, the client shows whether the fingerprint matched and still asks you to confirm the key. To sign your zone, see Enable DNSSEC.

Have more questions?

If you have additional questions or need any assistance with your DNS records, just contact support, and we will be happy to help. You can also read more about DNS hosting at DNSimple.