Look up a domain's DNSSEC public keys (DNSKEY records) with flags, algorithm and key tag.
How to use DNSKEY Lookup
Enter a domain name that you expect to be signed with DNSSEC.
Click Find DNSKEY.
Read the key list and the validation badge. The key tag of the KSK should match a DS record at the parent zone.
Worked example
cloudflare.com publishes a KSK with key tag 2371 and a ZSK, both using algorithm 13 (ECDSA P-256). Its DS record in .com also has key tag 2371, completing the chain of trust.
What is the difference between a KSK and a ZSK?
The key signing key (flag 257) signs the set of keys, and the zone signing key (flag 256) signs the other records. Splitting them makes routine key changes easier.
What is a key tag?
A short number calculated from the key data that lets resolvers quickly match a DS record or signature to the right key.
Put this guide into practice
DNSKEY Lookup — Look up a domain's DNSSEC public keys (DNSKEY records) with flags, algorithm and key tag.