CERT Certificate Common
Stores a certificate or certificate-related data directly in DNS.
What it's for
A CERT record stores a certificate, or data closely related to a certificate, directly in a DNS zone. It's a more general-purpose, older mechanism than TLSA (which came later and is purpose-built specifically for TLS certificate binding to a hostname/port) — CERT can hold PGP keys, X.509 certificates, or other certificate-format data, identified by a certificate type field.
In practice, CERT records see relatively limited real-world deployment compared to more specialized mechanisms that have emerged for specific use cases — PGP/OpenPGP key discovery has largely moved toward other mechanisms (like OPENPGPKEY, a closely related record type built on similar ideas to TLSA), and TLS-specific binding is handled by TLSA. CERT remains defined and usable but isn't the default choice for any single dominant use case today.
Format & syntax
example.com. 3600 IN CERT 3 0 0 Base64EncodedCertificateData...
- Type — a numeric or mnemonic identifier for the certificate format, e.g.
1(X.509 PKIX),3(PGP),6(IPKIX), among others defined in the CERT RR type registry - Key Tag — an identifier for the associated key, primarily meaningful in DNSSEC-adjacent contexts
- Algorithm — the algorithm used, when relevant to the certificate type
- Certificate/CRL — the base64-encoded certificate data itself
How it's used in practice
- PGP/OpenPGP key publication — historically one of CERT's more common uses: publishing a PGP public key (or a pointer to one) so mail clients or key-discovery tools could look it up via DNS rather than relying solely on keyservers. This use case has largely migrated toward the more specific OPENPGPKEY record type in modern deployments.
- General certificate storage for niche/internal tooling — some internal systems or specialized protocols use CERT records as a generic place to publish certificate data associated with a domain, though this is uncommon compared to purpose-built alternatives like TLSA for TLS specifically.
- Legacy compatibility — CERT records occasionally show up in older infrastructure or documentation predating more specialized record types; encountering one today is much more likely to mean "this is legacy" than "this is the current recommended approach" for whatever it's doing.
Common mistakes & gotchas
- Reaching for CERT when a more specific record type exists — for TLS certificates specifically, TLSA is the purpose-built, more widely supported choice. For SSH host keys, SSHFP. For PGP keys, OPENPGPKEY is the more modern, purpose-specific equivalent. CERT's generality is also its weakness — client and tooling support for CERT specifically is thin compared to these narrower alternatives.
- Assuming broad client support — CERT records exist in the spec and can technically be published, but very little mainstream software actually queries for and acts on them compared to TLSA/SSHFP, which have more concrete adoption in specific ecosystems (mail servers, SSH clients).
- Confusing certificate type codes — the type field has many defined values across different certificate formats and CRL-related types; using the wrong one for the data you're actually publishing makes the record unusable to anything that tries to parse it correctly.
Comparison & FAQ
| Type | Purpose | Key difference from CERT |
|---|---|---|
| TLSA | TLS certificate binding to a specific hostname/port | Purpose-built and more widely supported for TLS specifically, versus CERT's generic approach |
| SSHFP | SSH host key fingerprints | Narrower, purpose-specific alternative for SSH rather than general certificate storage |
| OPENPGPKEY | PGP public key publication in DNS | The modern, purpose-specific successor for the PGP use case CERT historically also covered |
Should I use CERT for publishing a TLS certificate?
No — TLSA is the purpose-built, more widely supported mechanism for binding TLS certificates to a hostname and port. CERT is a more general, less commonly implemented mechanism.
Is CERT still relevant today?
It's still a defined, valid record type, but for most specific use cases (TLS, SSH, PGP), more purpose-built record types (TLSA, SSHFP, OPENPGPKEY) have better real-world tooling and client support. Encountering CERT in the wild is more often a legacy artifact than a current best practice.
What kinds of certificates can a CERT record hold?
Multiple formats are defined via the type field, including X.509 (PKIX), PGP, and others in the CERT RR type registry — it's a general-purpose container rather than being tied to one specific certificate format.
Do modern mail clients or browsers use CERT records automatically?
Generally no — support for automatically querying and acting on CERT records is thin compared to more specialized alternatives, so relying on it for any production security mechanism isn't common practice.