DNSSEC - Revision history

Timo: /* Key Data Interface */

2024-02-29T16:25:53Z

‎Key Data Interface

Timo: /* DS Data Interface */

2024-02-29T16:17:32Z

‎DS Data Interface

WikiAdmin: /* Examples */

2017-03-23T08:35:43Z

‎Examples

Timo at 23:44, 4 September 2015

2015-09-04T23:44:34Z

WikiAdmin: /* Supported TLDs */

2015-03-02T12:40:14Z

‎Supported TLDs

WikiAdmin at 08:21, 4 September 2012

2012-09-04T08:21:07Z

80.129.74.105: /* Key Data Interface */

2012-08-28T18:02:04Z

‎Key Data Interface

80.129.74.105: /* DS Data Interface */

2012-08-28T18:00:56Z

‎DS Data Interface

80.129.74.105: /* General parameters */

2012-08-28T17:59:35Z

‎General parameters

80.129.74.105: /* Supported TLDs */

2012-08-28T17:06:25Z

‎Supported TLDs

← Older revision		Revision as of 16:25, 29 February 2024
Line 101:		Line 101:

	A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.		A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.
		+
		+	The Protocol Field MUST have value 3, no other values are accepted.


Line 106:		Line 108:

	A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.		A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.
		+
		+	RSA/MD5 (deprecated) - Algorithm Number 1<br/>
		+	Diffie-Hellman (deprecated) - Algorithm Number 2<br/>
		+	DSA/SHA-1 (deprecated) - Algorithm Number 3<br/>
		+	RSA/SHA-1 (deprecated) - Algorithm Number 5<br/>
		+	DSA-NSEC3-SHA1 (deprecated) - Algorithm Number 6<br/>
		+	RSA/SHA-1 (deprecated) - Algorithm Number 7<br/>
		+	RSA/SHA-256 - Algorithm Number 8<br/>
		+	DSA/SHA-1 (deprecated) - Algorithm Number 6<br/>
		+	ECDSA Curve P-256 with SHA-256 - Algorithm Number 13<br/>
		+	ECDSA Curve P-384 with SHA-384 - Algorithm Number 14<br/>
		+
		+	A number of these algorithms are now deprecated due to weaknesses in SHA-1. The remaining algorithms are 8, 13, and 14.<br/>
		+	These are just a few examples of algorithm types used in DNSSEC. It's important to note that algorithm support may vary depending on the DNS software and configuration in use by the registry.

← Older revision		Revision as of 16:17, 29 February 2024
Line 67:		Line 67:
	<pre>secDNS-ds digestType = <INT></pre>		<pre>secDNS-ds digestType = <INT></pre>

−	A parameter that contains a digest type value as described in Section 5.1.3 of RFC 4034.	+	A parameter that contains a digest-type value as described in Section 5.1.3 of RFC 4034.<br/>
		+	Available options are:<br/>
		+	SHA-1 (SHA1) - Digest Type 1<br/>
		+	SHA-256 (SHA256) - Digest Type 2<br/>
		+	GOST R 34.11-94 (GOST) - Digest Type 3<br/>
		+	SHA-384 (SHA384) - Digest Type 4
		+
		+	These digest types correspond to the digest algorithm used to generate the hash of the DNSKEY record, providing cryptographic integrity for DNSSEC. It's worth noting that the use of SHA-1 is now deprecated due to vulnerabilities, and SHA-256 is recommended for better security.

← Older revision		Revision as of 08:35, 23 March 2017
Line 111:		Line 111:

	domain = org-domain.org		domain = org-domain.org
−	~~secDNS-urgent = 1~~
	secDNS-ds0 = 27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0		secDNS-ds0 = 27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0

@@ Line 8: / Line 8: @@
-We made sure to create our API in a way to be compatible with all current and future DNSSEC enabled registry systems.
+We made sure to create our API to be compatible with all current and future DNSSEC enabled registry systems.
 Similar to the handling of contacts and nameservers, two (2) different ways exist for a registry to manage DNSSEC data for delegations:
@@ Line 17: / Line 17: @@
 The HEXONET API supports both types.
-Further, beyond just the required type, we have set up our system to also accept both DS and KEY data simultaneously for any TLD, so that anyone wishing to can simply submit both instead of having to determine which one is required for each TLD.
+Further, beyond just the required type, we have set up our system to also accept both DS and KEY data simultaneously for any TLD, so that anyone can simply submit both instead of having to determine which one is required for each TLD.
@@ Line 27: / Line 27: @@
 If DNSSEC is supported for HEXONET TLD´s, please see the respective SEC DNS column in the domain-detail view.
 == General parameters ==

@@ Line 26: / Line 26: @@
 == Supported TLDs ==
-Currently we support DNSSEC for five (5) TLDs in production:
+If DNSSEC is supported for HEXONET TLD´s, please see the respective SEC DNS column in the domain-detail view.
-−
-* '''.COM''': DS interface
-* '''.NET''': DS interface
-* '''.ORG''': DS interface, max 10 secDNS records
-* '''.DE''': KEY interface, max 5 secDNS records
-* '''.EU''': KEY interface, max 4 secDNS records
-* '''.SE''': DS interface, max 6 secDNS records
-* '''.UK''': DS interface, max 8 secDNS records
-−
-−
-More DNSSEC enabled TLDs will surely follow soon!
 == General parameters ==

@@ Line 1: / Line 1: @@
-{{Sidebar}}
+{{Sidebar}}__NOTOC__
 __NOTOC__
-−
 == DNSSEC (SecureDNS) ==

@@ Line 91: / Line 91: @@
 Key data may be provided OPTIONALLY when using the DS Data Interface, using these parameters:
-* '''secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)'''
+<pre>secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)</pre>
-* '''addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)'''
+<pre>addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>
-* '''delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)'''
+<pre>delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>
 The order of these whitespace-separated parameters matches the DNS DNSKEY record type.
-'''secDNS-key flags = <INT>'''
+<pre>secDNS-key flags = <INT></pre>
 A parameter that contains a flags field value as described in Section 2.1.1 of RFC 4034.
-'''secDNS-key protocol = <INT>'''
+<pre>secDNS-key protocol = <INT></pre>
 A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.
-'''secDNS-key alg = <INT>'''
+<pre>secDNS-key alg = <INT></pre>
 A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.
-'''secdns-key pubKey = <TEXT>'''
+<pre>secdns-key pubKey = <TEXT></pre>
 A parameter that contains an encoded public key field value as described in Section 2.1.4 of RFC 4034.
 The parameter is represented as a base64Binary [W3C.REC-xmlschema-2-20010502] with a minimum length of 1.
 == Examples ==

@@ Line 59: / Line 59: @@
 == DS Data Interface ==
-* '''secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)'''
+<pre>secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)</pre>
-* '''addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)'''
+<pre>addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>
-* '''delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)'''
+<pre>delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>
 The order of these whitespace-separated parameters matches the DNS DS record type.
-'''secDNS-ds keyTag = <INT>'''
+<pre>secDNS-ds keyTag = <INT></pre>
 A parameter that contains a key tag value as described in Section 5.1.1 of RFC 4034.
@@ Line 72: / Line 72: @@
-'''secDNS-ds alg = <INT>'''
+<pre>secDNS-ds alg = <INT></pre>
 A parameter that contains an algorithm value as described in Section 5.1.2 of RFC 4034.
-'''secDNS-ds digestType = <INT>'''
+<pre>secDNS-ds digestType = <INT></pre>
 A parameter that contains a digest type value as described in Section 5.1.3 of RFC 4034.
-'''secDNS-ds digest = <TEXT>'''
+<pre>secDNS-ds digest = <TEXT></pre>
 A parameter that contains a digest value as described in Section 5.1.4 of RFC 4034.
 The parameter is represented as a hexBinary [W3C.REC-xmlschema-2-20010502].
 == Key Data Interface ==

@@ Line 43: / Line 43: @@
 == General parameters ==
-'''secDNS-remove-all = 0 | 1 (ModifyDomain)'''
+<pre>secDNS-remove-all = 0 | 1 (ModifyDomain)</pre>
 This parameter is used to remove all DNSSEC records (DS and key data), if set to 1. A value of 0 will do nothing.
-'''secDNS-maxSigLife = <INT> (AddDomain/ModifyDomain)'''
+<pre>secDNS-maxSigLife = <INT> (AddDomain/ModifyDomain)</pre>
 An OPTIONAL parameter setting the preference for the number of seconds after signature generation. When the parent's signature on the DS information provided by the child will expire. There is ONLY ONE maxSigLife per domain. The use of this parameter depends on the registry operator, many TLDs will silently ignore it.
-'''secDNS-urgent = 0 | 1 (ModifyDomain)'''
+<pre>secDNS-urgent = 0 | 1 (ModifyDomain)</pre>
 This parameter is used to ask the server operator to complete and implement the update request with high priority. The use of this flag depends on the registry operator, many TLDs will silently ignore it.
 == DS Data Interface ==