How is the domain prefix formatted?

The local-part of the email (e.g. 'alice') is converted to lowercase UTF-8, hashed with SHA-256, and truncated to 28 octets (56 hexadecimal characters) prepended to '._openpgpkey.domain'.

Updated: August 2026 • Verified v1.2

DNS OPENPGPKEY Record Generator (RFC 7929)

Internet & NetworkNew

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

<SHA256_Truncated_28_Octets>._openpgpkey.<domain>. <TTL> IN OPENPGPKEY <Binary_Hex_Public_Key>

Was this calculation helpful?

Understanding Your Results

Computes the 28-octet local-part SHA-256 hash prefix, strips PGP armor headers, and outputs BIND zone records and dig verification commands.

Practical Guidance & Next Steps

Ensure your DNS zone is signed with DNSSEC; OpenPGP email clients will not trust OPENPGPKEY records without cryptographic DNSSEC validation.

What is this?

A cryptographic network utility that generates DNS OPENPGPKEY records for automated DANE-based email encryption key discovery.

How does it work?

1. Enter recipient email address. 2. Paste ASCII-armored PGP public key. 3. Instantly generate BIND zone record and CLI dig test command.

Why use it?

Enables secure, decentralized OpenPGP key publication directly within your DNSSEC trust hierarchy.

Technical Scope & Calculation Limitations

Requires PGP keys to fit within standard DNS UDP response size limits or require EDNS0/TCP fallback for large multi-sub-key rings.

Frequently Asked Questions

Specified in RFC 7929, OPENPGPKEY publishes a user's OpenPGP public key in the DNS under their email domain, enabling compliant mail user agents (MUAs) to discover encryption keys automatically.

Windows Desktop & Widget Options