Should I trust keys from DNS?

Only when the zone is DNSSEC-signed and validation succeeds.

Are these records common?

They are uncommon outside specific opportunistic-encryption setups.

IPSECKEY Record

An IPSECKEY record publishes the gateway and public key a host uses for IPsec connections, as defined in RFC 4025. This lookup shows any IPSECKEY records on a name.

When to use this: You are setting up or debugging opportunistic IPsec that reads keys from DNS. Command prefix ipseckey:

About the IPSECKEY Record

Look up IPSECKEY records, which publish IPsec gateway and public-key material in DNS (RFC 4025).

FAQ

Should I trust keys from DNS?: Only when the zone is DNSSEC-signed and validation succeeds.
Are these records common?: They are uncommon outside specific opportunistic-encryption setups.