How do I receive keys from keyservers, with GnuPG 2?

The GnuPG FAQ document recommends I use pool.sks-keyservers.net for the keyserver. That has worked for a long time in GnuPG 1, but in GnuPG 2:

$ gpg2 --keyserver pool.sks-keyservers.net --recv-keys DECAFBAD
gpg: keyserver receive failed: Invalid argument

What does “Invalid argument” mean? Which argument, and what validation failed?

Version information:

$ gpg2 --version
gpg (GnuPG) 2.1.15
libgcrypt 1.7.3-beta

How do I use gpg2 to receive a key from the keyserver network?


The usage of --keyserver name is deprecated in GnuPG 2. That's why it says:
keyserver receive failed: Invalid argument, because the argument is invalid, as in, deprecated.

Use --keyserver in dirmngr.conf instead.


You can use the following option in gpg2:


This will show any preferred keyserver URL in the --list-sigs or --check-sigs listings.

To list directories to search for and keyserver helpers, use:

--exec-path string
  • 1
    Deprecated does not mean invalid, but "will be removed in some future release, don't rely on it any more if you want to update at some time". Using it is totally fine, although I wouldn't recommend doing so when writing software that interfaces GnuPG.
    – Jens Erat
    Nov 1 '16 at 7:27

While the --keyserver option is indeed deprecated for the most recent versions of GnuPG, you can still use it. The issue you're having is another one: you have to specify the protocol you want to use.

From man gpg:

--keyserver name

      This option is deprecated - please use the --keyserver in ‘dirmngr.conf’

      Use name as your keyserver. This is the server that --recv-keys,
      --send-keys, and --search-keys will communicate with to receive keys from,
      send keys to,  and  search  for keys  on. The format of the name is a URI:
      `scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
      "hkp" for the HTTP (or compatible) keyservers, "ldap" for LDAP keyservers,
      or "mailto" for the Graff email keyserver. 

Especially observe that scheme: is not optional.

Use gpg2 --keyserver hkp://pool.sks-keyservers.net --recv-keys DECAFBAD instead to provide an ad-hoc change of the keyserver.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.