Skip to content
Blame Permalink
  • Jan Včelák's avatar
    ba2cb05a
    DNSSEC: use only compatible algorithms with NSEC/NSEC3 · ba2cb05a
    Jan Včelák authored 
    Key algorithm and used NSEC type must match:

RFC 5155 states, that for compatibility with old resolvers, NSEC3
must be used only with NSEC3 algorithms.

It makes no sense to sign NSEC with NSEC3 keys, because it will make
the validation impossible on NSEC3-unaware resolvers. This is stricter
than what dnssec-signzone from ISC does.

refs #4
    ba2cb05a
    DNSSEC: use only compatible algorithms with NSEC/NSEC3
    Jan Včelák authored 
    Key algorithm and used NSEC type must match:

RFC 5155 states, that for compatibility with old resolvers, NSEC3
must be used only with NSEC3 algorithms.

It makes no sense to sign NSEC with NSEC3 keys, because it will make
the validation impossible on NSEC3-unaware resolvers. This is stricter
than what dnssec-signzone from ISC does.

refs #4