Flexible, secure SSH with DNSSEC
Jan 13, 2016Etienne Labaume
Summary
This post introduces a new application of DNSSEC by demonstrating how public SSH keys can be securely stored in DNS TXT records. It details the technical implementation using OpenSSH's AuthorizedKeysCommand feature and unbound-host for DNSSEC validation, effectively turning Cloudflare's DNS into a Public Key Infrastructure (PKI) for SSH access. This enhances security by allowing dynamic revocation of access through DNS record removal and simplifies key management across multiple hosts.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available