DNSKEY는 공개 서명 키가 있는 DNS 레코드 유형입니다. DNSSEC 서명 영역을 또 다른 DNS 운영자로 마이그레이션하는 경우 DNSKEY 레코드를 확인해야 할 수 있습니다. RFC 6781의 마이그레이션 프로세스는 Cloud DNS 영역에서 영역 서명 키(ZSK) 및 키 서명 키(KSK) DNSKEY를 다른 운영자 영역으로 가져오는 것이 필요합니다.
영역에 DNSSEC를 사용 설정한 경우 Cloud DNS가 DNSSEC 키(DNSKEY 레코드) 생성 및 순환과 리소스 레코드 디지털 서명(RRSIG) 레코드를 사용한 영역 데이터 서명을 자동으로 관리합니다.
현재까지 KSK 순환을 위해서는 도메인 등록기관과의 직접 상호작용이 필요하기 때문에 Cloud DNS에서는 KSK의 자동 순환이 지원되지 않습니다.
하지만 Cloud DNS는 완전한 자동 ZSK 순환을 수행하지 않습니다.
Google Cloud CLI 또는 REST API를 사용하여 자동으로 관리되는 DNSKEY를 확인할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis page outlines how to view Domain Name System Security Extensions (DNSSEC) keys, which are stored as DNSKEY records.\u003c/p\u003e\n"],["\u003cp\u003eCloud DNS automatically manages the creation and rotation of Zone Signing Keys (ZSKs) but requires manual interaction for Key Signing Key (KSK) rotations.\u003c/p\u003e\n"],["\u003cp\u003eYou can view DNSKEYs using the Google Cloud CLI with the \u003ccode\u003egcloud dns dns-keys list\u003c/code\u003e and \u003ccode\u003egcloud dns dns-keys describe\u003c/code\u003e commands.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, you can use the REST API with the \u003ccode\u003ednsKeys.get\u003c/code\u003e method to view DNSKEYs, or utilize a Python script that leverages the \u003ccode\u003eapiclient\u003c/code\u003e library.\u003c/p\u003e\n"],["\u003cp\u003eBefore viewing DNSSEC keys, you must have a managed zone created and DNSSEC enabled for that zone.\u003c/p\u003e\n"]]],[],null,["# View DNSSEC keys\n\nThis page describes how to view Domain Name System Security Extensions\n(DNSSEC) keys.\n\nFor a conceptual overview of DNSSEC, see the [DNSSEC overview](/dns/docs/dnssec).\n\nA DNSKEY is a DNS record type that contains a public signing key. If you are\nmigrating a DNSSEC signed zone to another DNS operator, you might need to see\nthe DNSKEY records. The migration process in\n[RFC 6781](https://tools.ietf.org/html/rfc6781#section-4.3.5)\nrequires importing the Zone Signing Key (ZSK) and Key Signing Key (KSK)\nDNSKEYs from the Cloud DNS zone into the other operator's zone.\n\nIf you have enabled DNSSEC for a zone, Cloud DNS automatically manages\nthe creation and rotation of DNSSEC keys (DNSKEY records) and the signing of\nzone data with resource record digital signature (RRSIG) records.\nCloud DNS does not support automatic rotation of KSKs because KSK\nrotations currently require manual interaction with the domain registrar.\nHowever, Cloud DNS does perform fully automatic ZSK rotations.\nYou can view the automatically managed DNSKEYs with the Google Cloud CLI or\nREST API.\n\nBefore you begin\n----------------\n\nBefore you can view DNSSEC keys, you need to have\n[created a managed zone](/dns/docs/zones#creating_managed_zones) and\n[enabled DNSSEC for the zone](/dns/docs/dnssec-config#enabling)\nso that DNSKEY records are created.\n| **Note:** A DNSKEY collection is empty when `ManagedZones` are unsigned.\n\nDisplay current DNSKEYs\n-----------------------\n\nTo display the current DNSKEY records for your zone, follow these steps. \n\n### gcloud\n\nFor the following `gcloud` command-line examples, you can specify the\n`--project` parameter to operate on a specific project.\n\nTo print all DNSKEYs in JSON format, use the\n[`gcloud dns dns-keys list`](/sdk/gcloud/reference/dns/dns-keys/list)\ncommand: \n\n```\ngcloud dns dns-keys list --zone ZONE_NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of the managed zone.\n\nTo display the details of a specified DNSKEY in JSON format, use the\n[`gcloud dns dns-keys describe`](/sdk/gcloud/reference/dns/dns-keys/describe)\ncommand: \n\n```\ngcloud dns dns-keys describe DNSKEY_ID --zone ZONE_NAME\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eDNSKEY_ID\u003c/var\u003e: the ID of the DNSKEY for which you want to view details\n- \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: the name of the managed zone\n\n### API\n\nTo print all DNSKEYs to a `ResourceRecordSet` collection, use the\n[`dnsKeys.get`](/dns/docs/reference/v1/dnsKeys/get) method with an empty\nrequest body: \n\n```\nGET https://dns.googleapis.com/dns/v1/projects/PROJECT/managedZones/ZONE_NAME/dnsKeys\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name or ID of the DNS project\n- \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: the name of the managed zone\n\nYour output is similar to the following: \n\n```\n{\n \"kind\": \"dns#dnsKeysListResponse\",\n \"header\": {\n \"operationId\": string\n },\n \"dnsKeys\": [\n dnsKeys Resource\n ],\n \"nextPageToken\": string\n}\n```\n\nTo display the details of a specified DNSKEY in JSON format, use the\n[`dnsKeys `\u003cvar translate=\"no\"\u003eDNSKEY_ID\u003c/var\u003e`.get`](/dns/docs/reference/v1/dnsKeys/get)\nmethod with an empty request body: \n\n```\nGET https://dns.googleapis.com/dns/v1/projects/PROJECT/managedZones/ZONE_NAME/dnsKeys/DNSKEY_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name or ID of the DNS project\n- \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: the name of the managed zone\n- \u003cvar translate=\"no\"\u003eDNSKEY_ID\u003c/var\u003e: the ID of the DNSKEY for which you want to view details\n\n### Python\n\n```\n from apiclient import errors\n from apiclient.discovery import build\n\n PROJECT_NAME= 'PROJECT_NAME'\n ZONE_NAME= 'ZONE_NAME'\n\n try:\n service = build('dns', 'v1')\n response = service.dnskeys().list(project=PROJECT_NAME,\n managedZone=ZONE_NAME).execute()\n except errors.HttpError, error:\n print 'An error occurred: %s' % error\n\n try:\n response = service.dnskeys().list(project=PROJECT_NAME,\n managedZone=ZONE_NAME,\n keyId=KEY_ID).execute()\n except errors.HttpError, error:\n print 'An error occurred: %s' % error\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e: the name or ID of your DNS project\n- \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: the name of the managed zone\n\nWhat's next\n-----------\n\n- To get information about specific DNSSEC configurations, see [Use advanced DNSSEC](/dns/docs/dnssec-advanced).\n- To monitor changes, see [Monitor DNS propagation](/dns/docs/monitoring#dns-propagation).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
