Keyserver questions: where keys live now, privacy and removal

It stores public keys so other people can fetch yours by fingerprint, key ID or email address. They can then encrypt to you, check your signatures, or pick up updates such as a new subkey, a later expiry date or a revocation. A keyserver never sees your private key. It is just a place to publish the public half.

• keys.openpgp.org: launched in June 2019 by people from Enigmail, OpenKeychain and Sequoia PGP. It runs the Hagrid software, and since 2023 an elected board has governed it. It does not take part in the old SKS network and does not exchange data with other keyservers.
• keyserver.ubuntu.com: runs Hockeypuck, a synchronizing keyserver that swaps keys with other servers of its kind. It accepts uploads through a web form.
• Your own domain: with a Web Key Directory, programs fetch your key by email address straight from your domain’s web server. GnuPG checks WKD by default (auto-key-locate is local,wkd).

Some groups and distributions also run their own servers or keyrings. See Running a keyserver if you need one for an organization.

The pgp.net keyservers, and later the SKS keyserver pool most programs used by default, have stopped. The pool’s DNS records were pulled on June 21, 2021, after more GDPR takedown requests. The status page said the service was deprecated and no longer maintained. Old commands such as --keyserver subkeys.pgp.net now fail. What to use instead of subkeys.pgp.net has the replacement for each one, and Keyserver history tells the full story.

Since GnuPG 2.5.3 there is no default keyserver. GnuPG 2.5 is the stable series (2.5.24 as of November 2026). Earlier upstream versions used keyserver.ubuntu.com (from 2.2.29 and 2.3.2 on), and before that the SKS pool. Many Linux distributions set keys.openpgp.org for you. To set it yourself, put this line in ~/.gnupg/dirmngr.conf:

keyserver hkps://keys.openpgp.org

Then reload dirmngr with gpgconf --reload dirmngr. A keyserver line in gpg.conf still works but is deprecated. If an old dirmngr.conf has an hkp-cacert line from the SKS days, remove it. keys.openpgp.org warns that it stops normal certificates from working.

On keys.openpgp.org, upload the key and then confirm each address by clicking the link the server emails to it:

gpg --export you@example.org | curl -T - https://keys.openpgp.org

This prints a link to the verification page. gpg --send-keys also uploads, but it cannot start the email check. Your key is then stored, but nobody can find it by address.

gpg --auto-key-locate keyserver --locate-keys alice@example.org
gpg --recv-keys F135FBB3768D3CFC69D84DDC74C2EE549979B18B

Fetch by full fingerprint whenever you have one. keys.openpgp.org accepts only exact email addresses, long (16-digit) key IDs and fingerprints, and limits email lookups to about one per minute, with a burst allowance of 50. To pick up revocations and new subkeys for keys you already have, run gpg --refresh-keys from time to time.

No. On a synchronizing keyserver, anyone can upload a key with any name and address. keys.openpgp.org proves only that whoever verified the address could read mail sent to it at that moment. Before you rely on a key, check the fingerprint with its owner, or with a source you trust such as the project’s HTTPS website. See Key signatures.

The SKS design never deleted anything, so every key ever uploaded, along with every expired or forgotten one, was copied from server to server. Servers that carry that data still return those keys. Many people made a new key and never revoked the old one. Look at creation and expiry dates, ignore revoked or expired keys, and ask the person which fingerprint is current.

keys.openpgp.org strips every user ID whose owner has not verified it. A key without verified addresses still comes with its key material and any revocation, but has no name or address. Upstream GnuPG refuses to import a key that has no user ID, which leads to errors such as gpg: key A2604867523C7ED8: no user ID. Some distributions, Debian among them, patch GnuPG so that it accepts such updates for keys you already have; upstream declined that patch in 2020. The fix is on the owner’s side: verify the address, or publish the key through WKD. Note that an unpatched GnuPG also skips a revocation sent this way.

Since GnuPG 2.2.17 (2019), gpg ignores all third-party signatures on keys it gets from a keyserver. This was the answer to the 2019 certificate-flooding attack. The default keyserver-options include self-sigs-only and import-clean. keys.openpgp.org does not publish third-party certifications by default either. If you need someone’s signatures, get the key file from them directly.

It depends on the server.

• keys.openpgp.org: the manage page removes your published addresses after an email check. You do not need the key for this. The public key data itself is removed on request through the support address. Anyone can upload it again later, but you can ask for the key to be banlisted.
• Synchronizing keyservers: the GnuPG manual is blunt: “Keyservers are by design write only systems”, so a key cannot be deleted once sent. Even if one operator removes it, a peer may copy it back.

For keys that are still out there, publish a revocation. It does not remove the key, but it tells everyone to stop using it.

A user ID usually holds your name and email address, which is personal data. On a synchronizing keyserver it is public, searchable and copied to every peer. The SKS pool’s DNS was finally switched off after GDPR takedown requests, which the SKS software, built never to delete anything, could not carry out. keys.openpgp.org was built around consent. It publishes an address only after you verify it. It strips names without an address, photos and unknown packets. It lets you withdraw consent at any time. Its privacy policy says request logs are kept for 30 days with IP addresses anonymized. People in the EEA or UK can complain to their data protection authority.

It can see which keys or addresses are looked up from your IP address. Keeping keys in your keyring, refreshing them now and then instead of on every message, and using WKD for your own domain all reduce what any one server learns. GnuPG can also send all network traffic through Tor with dirmngr’s --use-tor option.