How do I configure SSH to use DNS SSHFP?

Add 'VerifyHostKeyDNS yes' to your ~/.ssh/config or run ssh with the '-o VerifyHostKeyDNS=yes' command line flag.

Updated: August 2026 • Verified v1.2

DNS SSHFP (SSH Fingerprint) Record Generator (RFC 4255 / RFC 7479)

Internet & NetworkNew

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

<Host> <TTL> IN SSHFP <Algorithm: 1=RSA, 2=DSA, 3=ECDSA, 4=Ed25519> <Type: 1=SHA1, 2=SHA256> <Hex_Fingerprint>

Was this calculation helpful?

Understanding Your Results

Generates formatted BIND master file lines, AWS Route53 JSON objects, and CLI verification test commands.

Practical Guidance & Next Steps

Always use Digest Type 2 (SHA-256) with Algorithm 4 (Ed25519) for maximum cryptographic strength and modern SSH client compatibility.

What is this?

A network infrastructure utility that constructs RFC-compliant DNS SSHFP resource records for automated SSH host key authentication.

How does it work?

1. Enter host FQDN. 2. Select key algorithm (Ed25519, ECDSA, RSA) and digest type (SHA-256). 3. Paste public key hex fingerprint. 4. Copy BIND zone record and verification commands.

Why use it?

Eliminates dangerous 'Host key verification failed' prompts and mitigates rogue DNS MITM attacks using DNSSEC trust chains.

Technical Scope & Calculation Limitations

Requires the target domain to have DNSSEC enabled for client SSH VerifyHostKeyDNS verification to succeed securely.

Frequently Asked Questions

An SSHFP (SSH Fingerprint) resource record publishes the cryptographic hash of an SSH server's public host key in DNS, allowing clients with DNSSEC to verify the host without manual fingerprint prompting.

Windows Desktop & Widget Options