Hardening First-Connect SSH Trust with SSHFP Records

Sun, 20 Sep 2026 00:00:00 +0000

Anyone who’s used SSH has seen this prompt on the first connection to a new host:

The authenticity of host 'example.com (203.0.113.1)' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no)?

The honest answer for most people, most of the time, is “I have no idea - but I’ll type yes anyway.” That’s trust-on-first-use (TOFU): SSH has no independent way to confirm the host key is genuine on that first connection, which is exactly the window in which a man-in-the-middle attack could substitute a different key without anyone noticing.

Dnscontrol on 5ok — sysadmin, devops, hosting

Hardening First-Connect SSH Trust with SSHFP Records