14

1) How do I know which servers are used to search for keys with gpg

gpg --search-key <keyword>

2) How to add a server to the list of queried server?

3 Answers 3

Reset to default
22

“Reputable” key servers exchange key updates with others, so using one is the same as using another (with slight delays in some cases). In the past, the recommendation was to use the SKS server pool, ideally using a secure connection; see the previous link for details, or this answer. However the pool has been disabled.

As of GPG 2.3.2 the default is to use keyserver.ubuntu.com; to do that with older releases, use:

gpg --keyserver keyserver.ubuntu.com --search-key ...

If you’re using that version or a later one, and you haven’t changed its default configuration, you’re good to go without specifying a key server manually.

If necessary, you can store the keyserver setting permanently by adding the relevant option to ~/.gnupg/dirmngr.conf (you may need to run gpgconf --reload dirmngr if the dirmngr daemon is already running):

keyserver hkps://keyserver.ubuntu.com

You can specify multiple keyserver options in that file, but I get the impression that only the last one is taken into account.

To actually answer your initial question, at least version 2.1 of GPG shows the key server used for a query:

$ gpg --search-key A36B494F
gpg: data source: https://host-37-191-236-118.lynet.no:443
...
1
  • For Debian (and Ubuntu) users, it’s worth noting that recent Debian versions of dirmngr have been patched so that <hkps://keys.openpgp.org> (a more privacy-conscious and stricter key-server that is less susceptible to attacks) is the default keyserver if none is explicitly configured. I believe newer versions of Fedora may also be using the same default keyserver.
    – Anthony Geoghegan
    Dec 21, 2021 at 20:31
4 
$ gpg -v --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
gpg: data source: https://162.213.33.8:443
gpg: armor header: Version: Hockeypuck ~unreleased
gpg: armor header: Comment: Hostname:
gpg: key 3804BB82D39DC0E3: number of dropped non-self-signatures: 108
gpg: pub  rsa4096/3804BB82D39DC0E3 2014-10-28  Michal Papis (RVM signing) <[email protected]>
gpg: key 3804BB82D39DC0E3: "Michal Papis (RVM signing) <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

The "data source" line tells which server was used.

This was run under Arch Linux, and for some reason (to be specific which server replied?) it doesn't tell the domain (under Debian it does), but you can do:

$ host 162.213.33.8
8.33.213.162.in-addr.arpa domain name pointer keyserver.ubuntu.com.

Alternatively you can inspect the source code. For Arch Linux, it uses the official version which switched to keyserver.ubuntu.com in 2.2.29, and 2.3.2. Debian is using keys.openpgp.org since 2.2.17 (there's also supposedly a non-released branch for 2.2.12).

As for adding keyservers to the list, you can make use of $GNUPGHOME/dirmngr.conf:

keyserver keys.openpgp.org

Make sure to gpgconf --reload dirmngr (or gpgconf --kill dirmngr) for the changes to take effect.

These 2 seem to be the recommended keyservers. See also this answer.

I decided to leave this part, just in case

A way to find it out with strace:

$ pkill dirmngr; strace -fs 1024 gpg --recv-keys 7D2BAF1CF37B13E2069D6956105BD0E739499BDB |& grep resolve_dns_addr
[pid 15102] write(2, "dirmngr[15101.5]: resolve_dns_addr for 'keys.openpgp.org': 'keys.openpgp.org' [already known]", 93) = 93
[pid 15102] write(2, "dirmngr[15101.5]: resolve_dns_addr for 'keys.openpgp.org': 'keys.openpgp.org' [already known]", 93) = 93

You need to kill dirmngr first, because it's it that interacts with keyservers, and if it's already running you won't be able to inspect what it's doing.

-f - trace child processes, -s - maximum string size to print (the default is 32).

1
  • 2
    I’ve upvoted your answer because it’s a useful complement to the accepted answer. I’d suggest setting hkps://keys.openpgp.org as the default key-server. Unlike the traditional HKP protocol which uses port 11371 (and can be blocked by corporate firewalls), it uses TLS (on port 443). I’d also say there’s no need to kill a running dirmngr process. Instead, you can get the running process to reload its configuration by running gpgconf --reload dirmngr.
    – Anthony Geoghegan
    Dec 21, 2021 at 21:01
2

This will list all keyservers dirmngr is currently using, starting it if necessary.

gpg-connect-agent --dirmngr 'keyserver' /bye
2
  • When I run this, I get this error. "ERR 67109139 Unknown IPC command <GPG Agent>" (twice)
    – Mathieu J.
    Feb 20 at 6:18
  • @MathieuJ.: You may have multiple gpg-agent processes running for some reason and it's connecting to the wrong one. If you want to start fresh, try running killall -v gpg-agent and then look into why you might have had more than one running.
    – Mark Gardner
    Jun 7 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .