How to verify host keys using OpenSSH and DNS---------------------------------------------OpenSSH contains support for verifying host keys using DNS as described indraft-ietf-secsh-dns-05.txt. The document contains very brief instructionson how to use this feature. Configuring DNS is out of the scope of thisdocument.(1) Server: Generate and publish the DNS RRTo create a DNS resource record (RR) containing a fingerprint of thepublic host key, use the following command:	ssh-keygen -r hostname -f keyfile -gwhere "hostname" is your fully qualified hostname and "keyfile" is thefile containing the public host key file. If you have multiple keys,you should generate one RR for each key.In the example above, ssh-keygen will print the fingerprint in ageneric DNS RR format parsable by most modern name serverimplementations. If your nameserver has support for the SSHFP RRyou can omit the -g flag and ssh-keygen will print a standard SSHFP RR.To publish the fingerprint using the DNS you must add the generated RRto your DNS zone file and sign your zone.(2) Client: Enable ssh to verify host keys using DNSTo enable the ssh client to verify host keys using DNS, you have toadd the following option to the ssh configuration file($HOME/.ssh/config or /etc/ssh/ssh_config):    VerifyHostKeyDNS yesUpon connection the client will try to look up the fingerprint RRusing DNS. If the fingerprint received from the DNS server matchesthe remote host key, the user will be notified.	Jakob Schlyter	Wesley Griffin$OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $