🚨 GPG Error: 'gpg: keyserver receive failed: No data' — Cause, Fix, and Troubleshooting Guide

What this error means

gpg --recv-keys asked a keyserver for a public key and got nothing usable back. GPG delegates network fetches to the dirmngr helper, so this failure is almost always about reachability, keyserver health, or a proxy — not the key material itself.

gpg: keyserver receive failed: No data

Common variants indicating the same class of problem:

gpg: keyserver receive failed: Connection timed out
gpg: keyserver receive failed: Server indicated a failure
gpg: keyserver receive failed: No keyserver available

Because the SKS keyserver network was deprecated, many old commands point at hosts that no longer answer, which is a frequent cause.

How it manifests on the host

• apt-key adv --recv-keys or gpg --recv-keys <ID> fails while adding a third-party repo.
• The same key ID imports fine on another network but not behind a corporate proxy.
• dirmngr errors appear alongside the failure.
• CI pipelines that fetch signing keys break intermittently.

System configuration causes

• Dead/deprecated keyserver. Legacy pgp.mit.edu / SKS pool hosts are unreliable or gone; the request returns no data.
• Firewall/proxy blocking. Port 11371 (HKP) or 443 (HKPS) is blocked, or an HTTP proxy is not honored by dirmngr.
• Stale dirmngr. A hung dirmngr process caches a broken connection state.
• Key not on that server. The specific key ID was never uploaded to the chosen keyserver.
• DNS/pool resolution failure. The round-robin keyserver pool resolves to an unreachable node.

Interrogating the host

# Retry with verbose keyserver debug to see what dirmngr actually does
gpg --keyserver hkps://keys.openpgp.org --debug-level guru --recv-keys <KEYID> 2>&1 | tail -20

# Is dirmngr healthy?
gpgconf --kill dirmngr && dirmngr --daemon
gpg-connect-agent --dirmngr 'keyserver --hosttable' /bye 2>/dev/null

# Can you reach a modern keyserver at all?
curl -sSf 'https://keys.openpgp.org/vks/v1/by-fingerprint/<FULL_FINGERPRINT>' -o /dev/null && echo reachable

If curl to keys.openpgp.org works but gpg does not, the problem is dirmngr/proxy config; if curl also fails, it is the network.

Remediation

1. Use a modern, maintained keyserver:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <KEYID>
# or Ubuntu's:  --keyserver hkps://keyserver.ubuntu.com

2. Restart dirmngr to clear a stuck state, then retry:

gpgconf --kill dirmngr
gpg --keyserver hkps://keys.openpgp.org --recv-keys <KEYID>

3. Point dirmngr at your proxy if you are behind one:

mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
printf 'honor-http-proxy\nhttp-proxy http://proxy.example.com:3128\n' >> ~/.gnupg/dirmngr.conf
gpgconf --kill dirmngr

4. Bypass keyservers entirely — the most robust approach for repo setup. Download the vendor’s armored key over HTTPS and import it directly:

curl -fsSL https://download.example.com/repo.gpg.key \
  | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg

Then pin the repo to that keyring with signed-by=.

Hardening the host

• Prefer signed-by= keyrings over the deprecated apt-key; a global keyring trusts a vendor key for every repo.
• Always verify the full fingerprint against the vendor’s published value before trusting an imported key — a reachable keyserver does not vouch for authenticity.
• HKPS (443) traverses restrictive firewalls far better than legacy HKP (11371); prefer it.
• In CI, fetching keys at build time is a network dependency and a supply-chain risk — vendor the key file into the image instead.

Related system errors

• GPG Repository Signature Verification Failed Error Guide
• ‘unable to get local issuer certificate’ Error Guide
• GPG ‘signing failed: Inappropriate ioctl for device’ Error Guide