RFC 6168

Requirements for Management of Name Servers for the DNS

📅 published May 2011, from ietf

Requirements for Management of Name Servers for the DNS 🎀

okay bestie, let's get into this RFC 6168 🦋✨ it's an Informational doc (so NOT a standards track thing, just here for vibes and guidance 💅), written by W. Hardaker of Sparta, Inc., and it dropped in May 2011 🌸. ISSN 2070-1721 if you're keeping receipts. It doesn't obsolete or update any other RFCs, so it's a clean slate, no cap 🧚

The whole point is that managing name servers for the Domain Name System (DNS) has traditionally been a total vendor-by-vendor mess 😭 Every company does its own monitoring, configuring, and control thing, and there's no interoperable way to manage the internal stuff of a name server. Some service monitoring tools can check that DNS itself works, but they can't look inside the server 💀 This doc is basically a shopping list of features a management system should have 🛍️🫶

Status of This Memo

This document is not an Internet Standards Track specification. It's published for informational purposes 🍓 It's a product of the IETF and represents the consensus of the IETF community. It got public review and was approved by the IESG. Not everything the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 for that 💅

Info about the current status, errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc6168 🌈

Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved 💜 This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date. Read those carefully, bestie, because they explain your rights and restrictions. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and come with no warranty 🔥

This document may contain material from IETF Documents or IETF Contributions published before November 10, 2008. Some of that material's copyright holders may not have let the IETF Trust allow modifications outside the IETF Standards Process. So without an adequate license from them, this doc can't be modified outside the IETF Standards Process, and derivative works can't be made outside it either, except to format it for publication as an RFC or to translate it into languages other than English 🙈

Table of Contents

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
  1.1.  Requirements Notation  . . . . . . . . . . . . . . . . . .  4
  1.2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  5
  1.3.  Document Layout and Requirements . . . . . . . . . . . . .  5
2.  Management Architecture Requirements . . . . . . . . . . . . .  5
  2.1.  Expected Deployment Scenarios  . . . . . . . . . . . . . .  5
    2.1.1.  Zone Size Constraints  . . . . . . . . . . . . . . . .  6
    2.1.2.  Name Server Discovery  . . . . . . . . . . . . . . . .  6
    2.1.3.  Configuration Data Volatility  . . . . . . . . . . . .  6
    2.1.4.  Protocol Selection . . . . . . . . . . . . . . . . . .  6
    2.1.5.  Common Data Model  . . . . . . . . . . . . . . . . . .  6
    2.1.6.  Operational Impact . . . . . . . . . . . . . . . . . .  7
  2.2.  Name Server Types  . . . . . . . . . . . . . . . . . . . .  7
3.  Management Operation Types . . . . . . . . . . . . . . . . . .  7
  3.1.  Control Requirements . . . . . . . . . . . . . . . . . . .  8
    3.1.1.  Needed Control Operations  . . . . . . . . . . . . . .  8
    3.1.2.  Asynchronous Status Notifications  . . . . . . . . . .  8
  3.2.  Configuration Requirements . . . . . . . . . . . . . . . .  9
    3.2.1.  Served Zone Modification . . . . . . . . . . . . . . .  9
    3.2.2.  Trust Anchor Management  . . . . . . . . . . . . . . .  9
    3.2.3.  Security Expectations  . . . . . . . . . . . . . . . .  9
    3.2.4.  TSIG Key Management  . . . . . . . . . . . . . . . . .  9
    3.2.5.  DNS Protocol Authorization Management  . . . . . . . . 10
  3.3.  Monitoring Requirements  . . . . . . . . . . . . . . . . . 10
  3.4.  Alarm and Event Requirements . . . . . . . . . . . . . . . 11
4.  Security Requirements  . . . . . . . . . . . . . . . . . . . . 11
  4.1.  Authentication . . . . . . . . . . . . . . . . . . . . . . 11
  4.2.  Integrity Protection . . . . . . . . . . . . . . . . . . . 11
  4.3.  Confidentiality  . . . . . . . . . . . . . . . . . . . . . 11
  4.4.  Authorization  . . . . . . . . . . . . . . . . . . . . . . 12
  4.5.  Solution Impacts on Security . . . . . . . . . . . . . . . 12
5.  Other Requirements . . . . . . . . . . . . . . . . . . . . . . 12
  5.1.  Extensibility  . . . . . . . . . . . . . . . . . . . . . . 12
    5.1.1.  Vendor Extensions  . . . . . . . . . . . . . . . . . . 13
    5.1.2.  Extension Identification . . . . . . . . . . . . . . . 13
    5.1.3.  Name-Space Collision Protection  . . . . . . . . . . . 13
6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 13
7.  Document History . . . . . . . . . . . . . . . . . . . . . . . 13
8.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 14
9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
  9.1. Normative References  . . . . . . . . . . . . . . . . . . . 14
  9.2. Informative References  . . . . . . . . . . . . . . . . . . 15
Appendix A.  Deployment Scenarios  . . . . . . . . . . . . . . . . 16
  A.1.  Non-Standard Zones . . . . . . . . . . . . . . . . . . . . 16
  A.2.  Redundancy Sharing . . . . . . . . . . . . . . . . . . . . 16
  A.3.  DNSSEC Management  . . . . . . . . . . . . . . . . . . . . 17

1. Introduction 🌸

okay so managing name servers for the DNS [RFC1034] [RFC1035] has always been done with vendor-specific monitoring, configuration, and control methods 😩 Some service monitoring platforms can test DNS itself, but there's no interoperable way to manage (monitor, control, and configure) the internal bits of a name server 💀

There was earlier IETF work that made two SNMP MIB modules [RFC1611] [RFC1612], but they never got significant implementation or deployment 😭 The reasons they flopped are written up in [RFC3197] 🫠

This doc is a shopping list of features a management system for name servers should have 🛍️ It only covers the name server part of a system, not the other elements 🙅‍♀️ Stub resolvers are specifically out of scope too. The doc doesn't set stub resolver requirements, though some of the requirements here apply to them as well ✨

Building a management system for DNS servers is not going to be small, obviously 🥹 Components will probably get designed in parts over time, and these requirements take that into account. Section 5.1 talks about future extensibility in particular 🧚 This is meant to be a roadmap, not an "all-or-nothing" system. Even partial interoperable management of name servers should help network operators a lot compared to the totally custom solutions used when this was written 🔥

1.1. Requirements Notation 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖💖

1.2. Terminology 🦋

This doc is consistent with the terminology in Section 2 of [RFC4033] 💅 Extra terms needed here are below:

Name Server: When we're talking about servers that don't fit a more specific category defined in other docs, this doc calls them "name servers" generically 🍓 Specifically, "name servers" can be any valid combo of authoritative, recursive, validating, or security-aware. The more specific labels get used when the doc is only talking about one type. But the term "name server" here does NOT include stub resolvers 🙅‍♀️

1.3. Document Layout and Requirements 🧚

Each numbered section has only a single requirement in it, if it has one at all 🦋 Each requirement contains needed wording from the terminology in Section 1.1. Subsections can exist with additional related requirements 💜 The layout is set up so a specific requirement can be uniquely referred to by its section number and the document version it came from ✨

2. Management Architecture Requirements 👑

This section covers requirements that reflect the needs of the expected deployment environments 🌈

2.1. Expected Deployment Scenarios 🌸

DNS zones vary a LOT in what they publish 😭 Name servers are deployed with all sorts of configurations to match that variety 🫶 It's super important that a management solution aiming for the criteria in this doc supports as many potential deployment cases as possible 🔥 Other deployment scenarios that aren't direct examples of specific requirements are listed in Appendix A 💅

2.1.1. Zone Size Constraints 🦋

The management solution MUST support both name servers serving a small number of potentially very large zones (e.g., Top Level Domains (TLDs)) AND name servers serving a very large number of small zones 🍓 Both scenarios are common, bestie 💖

2.1.2. Name Server Discovery 🧚

Large enterprise networks may have multiple name servers operating inside the enterprise network 🏢 These name servers may each serve multiple zones, both inside and outside the parent enterprise's zone 🌈 Finding and managing large numbers of name servers would be a useful feature of the resulting management solution ✨ The management solution MAY support the ability to discover previously unknown name server instances operating within a deployed network 🕵️‍♀️

2.1.3. Configuration Data Volatility 💜

Configuration data is defined as data that relates only to the configuration of a server and the zones it serves 📝 It specifically does NOT include data from the zone contents served through DNS itself 🙅‍♀️ The solution MUST support servers that stay statically configured over time AND servers that have numerous zones being added and removed within an hour ⏰ Both scenarios are common 🔥

Part 1 of 3. Keep going, more coming 🫶

2.1.4. Protocol Selection ✨

okay so there are SO many requirements in this doc for all kinds of management operations (go peek at Section 3 for the deets 👀). and honestly? no single protocol is gonna be perfect for all of them 😭 so you might end up needing multiple protocols to get a fully working management system 🧚. that's totally allowed! but the solution SHOULD still only require one 💅🎀

2.1.5. Common Data Model 🦋

bestie, defining a standardized protocol (or a set of them) for managing name servers is a huge step toward interoperability 🔥 BUT just picking a protocol isn't the whole story 💀 devices also need to represent their internal management interface using a common management data model. the solution MUST create a common data model that management stations can use when sending or collecting data from a managed device, so they can manage gear from different vendors as if it were a generic DNS server 🫶. this data model is needed for the operations stuff in Section 3, and it doesn't stop vendors from adding extra management infrastructure on top of the base spec (more on that in Section 5.1) 🌈

2.1.6. Operational Impact 🌸

ngl, adding new features to an existing server (like a management infrastructure) is going to impact the existing service or server somehow 😭 at minimum you'll need more memory, disk, and/or CPU to run the new management system 💜. BUT the impact on the existing DNS service MUST be minimized, because DNS is still the main event here 👑 the management solution MUST NOT result in an increase of the number of unhandled DNS requests 🙅‍♀️✨

2.2. Name Server Types 🎀

there are a bunch of ways name servers can be deployed. they can be any of these roles:

Master Servers
Slave Servers
Recursive Servers

the management solution SHOULD support all of these types because they're all equally important 🍓 also, "Recursive Servers" can be broken down further by the security sub-roles they might implement, as defined in section 2 of [RFC4033] 🔐. those sub-roles are important to support too, bestie 💖

as we said earlier, managing stub resolvers is out of scope for this doc 🙈

Management Operation Types 🌈

management operations can traditionally be sorted into four categories:

Control
Configuration
Health and Monitoring
Alarms and Events

this section digs into the detailed requirements for each of these four categories 🦋

3.1. Control Requirements 💅

the management solution MUST be capable of performing basic service control operations 🔥

3.1.1. Needed Control Operations ✨

these operations SHOULD include, at a minimum, the following:

Starting the name server
Reloading the service configuration
Reloading all of the zone data
Reloading individual zone data sets
Restarting the name server
Stopping the name server

no restrictions on how the management system actually implements these 🧚 but at least "starting the name server" will need a minimal management system component that exists independently of the name server itself 💀

3.1.2. Asynchronous Status Notifications 🫧

some control operations can take a long time to finish. like, some name servers take forever to reload big zones 😭 because of that, the management solution SHOULD take this into account and offer a mechanism to ease the burden of waiting on a long-running command 🥺 this could be asynchronous notifications that report the status of a long-running task, or the management station might have to poll for status using monitoring commands 💜. these options (and any others) need to be evaluated carefully so the one picked balances result delivery needs against the perceived implementation costs 🎀

also, check out the related discussion in Section 3.4 on notification messages for delivering alarm and event messages 🦋

3.2. Configuration Requirements 🌸

a lot of name server features need to be configured before the server can be considered functional 🛠️ the management solution MUST be able to provide name servers with configuration data 🔥. the most important data to configure is, for example, the served zone data itself 👑

3.2.1. Served Zone Modification 🌈

the ability to add, modify, and delete zones being served by name servers is needed 💅. there are already solutions for zone content modification, like Dynamic DNS (DDNS) [RFC2136] [RFC3007], full zone transfer (AXFR) [RFC5936], and incremental zone transfer (IXFR) [RFC1995], and these might be used as part of the final management solution ✨. still, the management system SHOULD still be able to create a new zone (with enough minimal data to let the other mechanisms work too) and to delete a zone 🧚. for example, this could be a management operation that creates at least the initial SOA (Start of Authority) record for a new zone, since that's the minimum zone data the other operations need to function 🫶

3.2.2. Trust Anchor Management 🔐

the solution SHOULD support adding, modifying, and deleting trust anchors used by DNS Security (DNSSEC) [RFC4033] [RFC4034] [RFC4035] [RFC4509] [RFC5011] [RFC5155] 💖. these trust anchors might be configured using the data from the DNSKEY Resource Records (RRs) themselves, or by using Delegation Signer (DS) fingerprints 🦋

3.2.3. Security Expectations 🛡️

DNSSEC validating resolvers need to make policy decisions about the requests they process 🧠. for example, they need to be configured with a list of zones that are expected to be secured by DNSSEC 🔐. the management solution SHOULD be able to add, modify, and delete attributes of DNSSEC security policies 💅

3.2.4. TSIG Key Management 🔑

TSIG [RFC2845] allows transaction-level authentication of DNS traffic 🌸. the management solution SHOULD be able to add, modify, and delete TSIG keys known to the name server ✨

3.2.5. DNS Protocol Authorization Management 👑

the management solution SHOULD have the ability to add, modify, and delete authorization settings for the DNS protocols themselves 💅. don't mix this up with managing authorization for the management protocol itself, which is covered later in Section 4.4 ⚠️. a name server uses a number of authorization settings, and example settings the solution might need to cover are:

Access to operations on zone data (e.g., DDNS)
Access to certain zone data from certain sources (e.g., from particular network subnets)
Access to specific DNS protocol services (e.g., recursive service)

Note: the list above is just a collection of examples and is NOT a complete list of needed authorization protections 🙃

3.3. Monitoring Requirements 📊

monitoring is the process of collecting aspects of a name server's internal state at a given moment in time 👀. the solution MUST be able to monitor the health of a name server to figure out its operational status, load, and other internal attributes 💜. example parameters the solution might need to collect and analyze are:

Number of requests sent, responses sent, number of errors, average response latency, and other performance counters
Server status (e.g., "serving data", "starting up", "shutting down", etc.)
Access control violations
List of zones being served
Detailed statistics about clients interacting with the name server (e.g., top 10 clients requesting data)

Note: the list above is just a collection of examples and is NOT a complete list of needed monitoring operations. some monitoring stats are expected to be computationally or resource expensive, so they're considered "nice to have" rather than "necessary to have" 🥹

3.4. Alarm and Event Requirements 🚨

events at the name server that trigger alarm notifications can quickly tell a management station about critical issues 😱. a management solution SHOULD include support for delivering alarm conditions 🔔

example alarm conditions might include:

The server's status is changing (e.g., it is starting up, reloading configuration, restarting, or shutting down).
A needed resource (e.g., memory or disk space) is exhausted or nearing exhaustion.
An authorization violation was detected.
The server has not received any data traffic (e.g., DNS requests or NOTIFYs) recently (aka the "lonely warning"). This condition might indicate a problem with the server's deployment 🥺
The number of errors has exceeded a configured threshold.

Security Requirements 🔒

this is the serious part, bestie 😤 the management solution will need to be properly secured against attacks on the management infrastructure 🛡️

4.1. Authentication 🪪

the solution MUST support mutual authentication 🤝. the management client needs to be assured that management operations are going to and from the correct name server ✅. the managed name server needs to authenticate the system that's accessing the management infrastructure within itself 💅

4.2. Integrity Protection 🧷

management operations MUST be protected from modification while in transit from the management client to the server 🚫✏️

4.3. Confidentiality 🤫

the management solution MUST support message confidentiality 🔐. the transfer of sensitive configuration is expected (things like TSIG keys or security policies) 🗝️. the solution doesn't, however, necessarily need to provide confidentiality for data the DNS system itself would normally carry without it 🙂

4.4. Authorization 👑

the solution SHOULD provide an authorization model that can selectively authorize individual management requests for any management protocols it introduces into the completed system 💅. this is different from the authorization we talked about in Section 3.2.5 because this requirement is ONLY about authorizing the management system itself 🫶

there are a number of authorization settings a managed system might use to decide whether the managing entity is allowed to perform a given management task. example settings the solution might need to cover are:

Access to the configuration that specifies which zones are to be served
Access to the management system infrastructure
Access to other control operations
Access to other configuration operations
Access to monitoring operations

Note: the list above is just a collection of examples and is NOT a complete list of needed authorization protections 💖

4.5. Solution Impacts on Security ✨

Okay bestie, security time 🔐 The solution MUST minimize the security risks it brings to the whole name server system. Adding new infrastructure to a server always touches security somehow, because even a management protocol on its own opens a brand-new avenue for attack 😭 The management benefits are worth the extra risk, ngl, but the solution still has to keep that impact as small as it possibly can 💅

5. Other Requirements 🎀

5.1. Extensibility 🦋

So the management solution is expected to change and grow over time, as lessons get learned and new DNS features get deployed 🌈 That means the solution MUST be flexible and able to handle new future management operations. For example, it might use protocol versioning or capability description exchanges, so that management stations and name servers that weren't written to the same specification version can still interoperate to the best of their combined ability 🫶

5.1.1. Vendor Extensions 💜

It MUST be possible for vendors to extend the standardized management model with vendor-specific extensions, so they can support additional features offered by their products ✨

5.1.2. Extension Identification 🔍

It MUST be possible for a management station to understand which parts of returned data are specific to a given vendor or other standardized extension. The returned data needs to be properly marked, through name spaces or similar mechanisms, so the base management model data can be logically separated from the extension data without the station needing to understand the extension data itself 🧠

5.1.3. Name-Space Collision Protection 🛡️

It MUST be possible to protect against multiple extensions conflicting with each other. Name-space protection mechanisms for communicated management variables are common practice for guarding against these problems 💅 Name-space identification techniques also frequently solve the "Extension Identification" requirement discussed in Section 5.1.2 🎀

6. Security Considerations 🚨

Okay this one is serious, so listen up 👀 Any management protocol that claims conformance to this document needs to fully support the criteria discussed in Section 4, so it can protect the management infrastructure itself. The DNS is a core Internet service, and the management traffic that protects it could become the target of attacks designed to take that service down 😭 Because the management infrastructure adds extra interfaces to that service, it is critical that the management infrastructure supports adequate protections against network attacks 🔥

7. Document History 📜

A requirement-gathering discussion was held at the December 2007 IETF meeting in Vancouver, BC, Canada, and a follow-up meeting was held at the March 2008 IETF meeting in Philadelphia. This document compiles the results of those discussions, along with discussions on the DCOMA mailing list 🌸

8. Acknowledgments 🫶

This document came out of discussions within the DCOMA design team, chaired by Jaap Akkerhuis. The team had a large number of people, all of whom gave valuable insight and input into the discussions about name server management 💖 The text was written from notes taken during meetings, as well as from contributions sent to the DCOMA mailing list. This work documents the consensus of the DCOMA design team ✨

The following team members contributed significantly to the text:

Stephane Bortzmeyer
Stephen Morris
Phil Regnauld

Further editing contributions and wording suggestions came from Alfred Hoenes and Doug Barton 👑

9. References 📚

9.1. Normative References

[RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
[RFC1995] Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995, August 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2136] Vixie, P., Thomson, S., Rekhter, Y., and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, April 1997.
[RFC2845] Vixie, P., Gudmundsson, O., Eastlake, D., and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", RFC 2845, May 2000.
[RFC3007] Wellington, B., "Secure Domain Name System (DNS) Dynamic Update", RFC 3007, November 2000.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, March 2005.
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, March 2005.
[RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, March 2005.
[RFC4509] Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)", RFC 4509, May 2006.
[RFC5011] StJohns, M., "Automated Updates of DNS Security (DNSSEC) Trust Anchors", RFC 5011, September 2007.
[RFC5155] Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNS Security (DNSSEC) Hashed Authenticated Denial of Existence", RFC 5155, March 2008.
[RFC5936] Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol (AXFR)", RFC 5936, June 2010.

9.2. Informative References

[RFC1611] Austein, R. and J. Saperia, "DNS Server MIB Extensions", RFC 1611, May 1994.
[RFC1612] Austein, R. and J. Saperia, "DNS Resolver MIB Extensions", RFC 1612, May 1994.
[RFC2182] Elz, R., Bush, R., Bradner, S., and M. Patton, "Selection and Operation of Secondary DNS Servers", BCP 16, RFC 2182, July 1997.
[RFC3197] Austein, R., "Applicability Statement for DNS MIB Extensions", RFC 3197, November 2001.

Appendix A. Deployment Scenarios 🧚

This appendix covers some extra deployment scenarios that have traditionally been hard to manage 🥺 They're offered as guidance for protocol developers, as data points on real-world name server management problems.

A.1. Non-Standard Zones 🏠

If an organization uses non-standard zones (for example, a purely local TLD), synchronizing all the name servers for those zones is usually a time-consuming task 😩 It gets even worse when two organizations with conflicting zones merge. This is not a recommended deployment scenario (and is even heavily discouraged), but unfortunately it's seen in the wild 💀

It's typically implemented using "forwarding" zones. But there's no way to automatically ensure that all the resolvers have the same set of zones to forward at any given time. New zones might be added to a local forwarding recursive server, for example, without modifying the rest of the deployed forwarding servers. It is hoped that a management solution able to handle the configuration of zone forwarding would finally allow management of servers deployed this way 🙏

For reliability reasons, it is recommended that zone operators follow the guidelines documented in [RFC2182], which recommends configuring multiple name servers for each zone and separating those name servers both physically and via connectivity routes. A common solution is a DNS-serving partnership: "I'll host your zones and you'll host mine" 🫶 Both sides benefit from increased DNS reliability through the wider service distribution. This frequently happens between cooperating but otherwise unrelated entities (such as two distinct companies), as well as between affiliated organizations (such as branch offices within a single company).

The configuration of these relationships is currently required to be manually configured and maintained 😤 Changes to the list of cross-hosted zones are manually negotiated between the cooperating network administrators and configured by hand. A management protocol with the ability to provide selective authorization, as discussed in Section 4.4, would solve many of the management difficulties between cooperating organizations 👑

A.3. DNSSEC Management 🔐

There are many different DNSSEC deployment strategies that may be used for mission-critical zones. The following list describes some example deployment scenarios that might warrant different management strategies:

All contents and DNSSEC keying information controlled and operated by a single organization.
Zone contents controlled and operated by one organization, with all DNSSEC keying information controlled and operated by a second organization.
Zone contents controlled and operated by one organization, zone signing keys (ZSKs) controlled and operated by a second organization, and key signing keys (KSKs) controlled and operated by a third organization.

This list isn't exhaustive, since there are other ways zone data can be divided up, but it should be enough to show how zone data can be controlled by multiple entities 🧩

The end result of all of these strategies, though, is the same: a live zone containing DNSSEC-related resource records ✨ Many of the strategies above are just different ways of preparing a zone for serving. A management solution that includes support for managing DNSSEC zone data may wish to take these potential management scenarios into account 🌈

Author's Address 💌

Wes Hardaker
Sparta, Inc.
P.O. Box 382
Davis, CA  95617
US

Phone: +1 530 792 1913
EMail: ietf@hardakers.net

📦 where this page comes from

ietf: rfc6168 2011-05
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms