---
type: concept
title: SSHFP
tags: [ssh, dns, security]
related: [dnssec, openssh]
created: 2026-07-01
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_support_dokumentation_anleitungen_dnssec_macos.md"]
---

# SSHFP

**SSHFP** (SSH Fingerprint) is a DNS record type that stores the fingerprint of an SSH server's public key. This allows an SSH client to verify the host key of a server via DNS before establishing a connection, reducing the reliance on "Trust on First Use" (TOFU).

## Requirements for Use
1. **DNSSEC:** Because DNS records can be spoofed, SSHFP requires [[dnssec]] to ensure that the fingerprint retrieved from DNS is authentic and has not been tampered with.
2. **Compatible Client:** The SSH client must support the `VerifyHostKeyDNS` option. 

## macOS Implementation Note
The native OpenSSH client provided by macOS is unable to work with SSHFP records due to its underlying libraries. To enable this functionality, a version of OpenSSH installed via Homebrew is required.
