A Secure Shell fingerprint record (abbreviated as SSHFP record) is a type of resource record in the Domain Name System (DNS) which identifies SSH keys that are associated with a host name. The acquisition of an SSHFP record needs to be secured with a mechanism such as DNSSEC for a chain of trust to be established.
⟨Name⟩ [⟨TTL⟩] [⟨Class⟩] SSHFP ⟨Algorithm⟩ ⟨Type⟩ ⟨Fingerprint⟩
- The name of the object to which the resource record belongs (optional)
- Time to live (in seconds). Validity of Resource Records (optional)
- Protocol group to which the resource record belongs (optional)
- Algorithm (0: reserved; 1: RSA; 2: DSA, 3: ECDSA; 4: Ed25519 6:Ed448;)
- Algorithm used to hash the public key (0: reserved; 1: SHA-1; 2: SHA-256)
- Hexadecimal representation of the hash result, as text
host.example.com. SSHFP 4 2 123456789abcdef67890123456789abcdef67890123456789abcdef123456789
In this example, the host with the domain name
host.example.com uses a Ed25519 key with the SHA-256 fingerprint
123456789abcdef67890123456789abcdef67890. This output would be produced by a
ssh-keygen -r host.example.com. command on the target server by reading the existing default SSH host key (Ed25519).
- "RFC 4255 — Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints". January 2006. Retrieved 2017-12-28.
- "RFC 6594 — Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records". April 2012. Retrieved 2017-12-28.
- "RFC 7479 — Using Ed25519 in SSHFP Resource Records". March 2015. Retrieved 2017-12-28.
- "RFC 8709 — Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol". February 2020. Retrieved 2021-10-16.
- "ssh-keygen(1) - Linux manual page". www.man7.org. Retrieved 2023-03-25.
- "ssh-keyscan(1)". OpenBSD manual pages.