RFC 8901

Multi-Signer DNSSEC Models

📅 published September 2020, from ietf

Multi-Signer DNSSEC Models 🎀

Okay bestie, this is RFC 8901, called Multi-Signer DNSSEC Models 🦋. It's an IETF doc in the Informational category, which means it's published for information and isn't a Standards Track spec 📚. It's listed under ISSN 2070-1721 and dated September 2020. The authors are S. Huque, P. Aras, J. Dickinson, J. Vcelak, and D. Blacka. Huque and Aras are from Salesforce, Dickinson is from Sinodun IT, Vcelak is from NS1, and Blacka is from Verisign 🌸. The header doesn't list any RFCs that it obsoletes or updates, so it's a standalone vibe ✨.

Abstract 💖

Lots of enterprises use multiple DNS providers to serve their authoritative DNS 🌐. Putting DNSSEC on top of that can be a little tricky, depending on the configuration and which features are in play 🧩. The big plot twist is that when every provider signs the zone data with its own keys, you need extra key-management mechanisms 🔑. This doc lays out deployment models for that exact situation and describes those key-management requirements 📋. The best part is that these models don't require any changes to how validating resolvers behave, and they don't slap new key-management requirements onto authoritative servers that aren't in a multi-signer setup 💅.

Status of This Memo ℹ️

This document is not an Internet Standards Track specification. It's published for informational purposes only 📖.

This is a product of the Internet Engineering Task Force (IETF), and it represents the consensus of the IETF community 🫶. It went through public review and got the green light from the Internet Engineering Steering Group (IESG) 🎉. Not every doc the IESG approves is a candidate for any level of Internet Standard, so check out Section 2 of RFC 7841 for the deets 🤓.

You can find the current status of this document, any errata, and how to send feedback at https://www.rfc-editor.org/info/rfc8901 🔗.

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 📜. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're also provided without warranty, as described in the Simplified BSD License 🛡️.

Table of Contents 🗺️

1.  Introduction and Motivation
2.  Deployment Models
  2.1.  Multiple-Signer Models
    2.1.1.  Model 1: Common KSK Set, Unique ZSK Set per Provider
    2.1.2.  Model 2: Unique KSK Set and ZSK Set per Provider
3.  Validating Resolver Behavior
4.  Signing-Algorithm Considerations
5.  Authenticated-Denial Considerations
  5.1.  Single Method
  5.2.  Mixing Methods
6.  Key Rollover Considerations
  6.1.  Model 1: Common KSK, Unique ZSK per Provider
  6.2.  Model 2: Unique KSK and ZSK per Provider
7.  Using Combined Signing Keys
8.  Use of CDS and CDNSKEY
9.  Key-Management-Mechanism Requirements
10. DNS Response-Size Considerations
11. IANA Considerations
12. Security Considerations
13. References
  13.1.  Normative References
  13.2.  Informative References
Acknowledgments
Authors' Addresses

1. Introduction and Motivation 🌟

Lots of enterprises use multiple Domain Name System (DNS) [RFC1034] [RFC1035] providers to distribute their authoritative DNS service 🌍. They do this mainly for redundancy and availability, so the DNS service can survive a complete, catastrophic failure of any single provider 💪. Sometimes enterprises or providers also have requirements that rule out standard zone-transfer techniques [RFC1995][RFC5936] 🙅‍♀️. Maybe they use nonstandardized DNS features that don't work with zone transfer, or maybe a provider has to be able to (re-)sign DNS records using its own keys 🔁. This document outlines some possible models of DNSSEC [RFC4033] [RFC4034] [RFC4035] deployment in that kind of environment 🦋.

This doc assumes you already have a reasonable level of familiarity with DNS operations and protocol terms 🧠. If you need a refresher, a lot of the terminology gets explained in more detail in "DNS Terminology" [RFC8499] 📖.

2. Deployment Models 🏗️

If a zone owner can use standard zone-transfer techniques, then having multiple providers doesn't require changes to the normal deployment models 😌. In these setups there's a single signing entity, which could be the zone owner, one of the providers, or a separate entity, while the providers act as secondary authoritative servers for the zone 🎯.

Occasionally, though, standard zone-transfer techniques can't be used 😬. That could be because of nonstandard DNS features, or because of the operational requirements of a given provider (e.g., a provider that only supports "online signing"). In these situations, the multiple providers each act like primary servers. They independently sign data received from the zone owner and serve it to DNS queriers 🌈. This configuration brings some novel challenges and requirements, so buckle up 🎢.

2.1. Multiple-Signer Models 👯

In this category of models, multiple providers each independently sign and serve the same zone 💖. The zone owner usually uses provider-specific APIs to update the zone content identically at each provider, and then relies on each provider to do the signing 🤝. A key requirement here is managing the contents of the DNSKEY and Delegation Signer (DS) RRsets so that validating resolvers always have a viable path to authenticate the DNSSEC signature chain, no matter which provider gets queried 🛤️. The way this works is that each provider imports the public Zone Signing Keys (ZSKs) of all the other providers into its own DNSKEY RRset 🔐.

These models can support DNSSEC even for the nonstandard features mentioned earlier, as long as the DNS providers can sign the response data those features generate ✍️. Those responses are often generated dynamically at query time, so one method is for the provider to do online signing, also known as on-the-fly signing ⚡. Another possible approach is to precompute all the possible response sets and their associated signatures, and then figure out algorithmically, at query time, which response set and signature need to be returned 🧮.

In the models presented here, coordinating the DNSKEY or DS RRset doesn't involve the providers talking to each other directly 🙈. Feedback from several commercial managed-DNS providers suggests they may be unlikely to communicate directly, since they usually only have a contractual relationship with the zone owner 📝. Still, if the parties involved are agreeable, it may be possible to devise a protocol mechanism that lets the providers communicate directly to share keys 🤙. Details of any such protocol are deferred to a future specification document, should there be interest 🔮.

In the descriptions below, the Key Signing Key (KSK) and Zone Signing Key (ZSK) match the definitions in [RFC8499]. There's one caveat, though: the KSK doesn't just sign the zone apex DNSKEY RRset. It also serves as the Secure Entry Point (SEP) into the zone 🚪✨.

2.1.1. Model 1: Common KSK Set, Unique ZSK Set per Provider 🔑

The zone owner holds the KSK set, manages the DS record set, and is responsible for signing the DNSKEY RRset and distributing it to the providers 👑.
Each provider has its own ZSK set, which it uses to sign data in the zone 💅.
The providers have an API that the zone owner uses to query the ZSK public keys and insert a combined DNSKEY RRset. That combined set includes the ZSK sets of each provider plus the KSK set, which is signed by the KSK 🧩.
Heads up: even if the contents of the DNSKEY RRset don't change, the zone owner still needs to periodically re-sign it as the signature expiration approaches ⏰. The provider API is also used to periodically redistribute the refreshed DNSKEY RRset 🔄.
Key rollovers need coordinated participation from the zone owner to update the DNSKEY RRset (for KSK or ZSK) and the DS RRset (for KSK) 🤝💫.
(One specific variant of this model that may be interesting is a configuration in which there is only a single provider. A possible use case for this is where the zone owner wants to outsource the signing and operation of their DNS zone to a single third-party provider but still control the KSK, so that they can authorize and/or revoke the use of specific zone signing keys 🦋.)

2.1.2. Model 2: Unique KSK Set and ZSK Set per Provider 🌸

Each provider has its own KSK and ZSK sets 🎀.
Each provider offers an API that the zone owner uses to import the ZSK sets of the other providers into their DNSKEY RRset 🛍️.
The DNSKEY RRset is signed independently by each provider using its own KSK 🖊️.
The zone owner manages the DS RRset located in the parent zone. This is made up of DS records corresponding to the KSKs of each provider 📂.
Key rollovers need coordinated participation from the zone owner to update the DS RRset (for KSK) and the DNSKEY RRset (for ZSK) 🥰.

3. Validating Resolver Behavior ✨

Okay bestie, this section is where things can get messy 😭. The main requirement for both multi-signer models (Section 2.1) is that the ZSKs from every participating provider show up in each provider's apex DNSKEY RRset, and that the KSK vouches for them. In Model 1 that's the single shared KSK, and in Model 2 it's each provider's own KSK 💅. If that doesn't happen, here's how the drama goes (let's say two providers, A and B):

The validating resolver follows a referral (aka a secure delegation) to the zone in question. 🦋
It grabs the zone's DNSKEY RRset from one of Provider A's nameservers, checks it against the parent's DS RRset, and caches it. 🧚
Later on, the resolver tries to resolve a name in the zone while that Provider A DNSKEY RRset is still fresh in its cache. 🌸
It asks one of Provider B's nameservers and gets back a response signed by Provider B's ZSK. Sadly, it can't authenticate that, because this ZSK isn't in the cached DNSKEY RRset it got from Provider A 😭.
The resolver won't accept the response. It might still authenticate the name eventually by asking other nameservers for the zone until one of Provider A's nameservers answers. But it has already paid for extra round trips to other nameservers, with the latency and processing costs that come with them 💀. How many extra round trips you get depends on the resolver's nameserver-selection algorithm and on how many nameservers Provider B has configured.
It's also possible that the resolver can't give an authenticated answer because it gave up after a certain number of retries or a certain amount of delay. Or the downstream clients that sent the original query may have timed out while waiting ⏳.

So, it's super important that the DNSKEY RRset at each provider stays stocked with the active ZSKs from all participating providers. That way, resolvers can validate a response no matter which provider's nameservers it came from 👑.

How the DNSKEY RRset itself gets validated is different in each model. In Model 1 (Section 2.1.1), one unique KSK managed by the zone owner signs an identical DNSKEY RRset deployed at each provider, and the signed DS record in the parent zone points to that KSK 🎀. In Model 2 (Section 2.1.2), each provider has its own KSK and uses it to sign the DNSKEY RRset. The zone owner publishes a DS RRset in the parent zone with multiple DS records, each pointing to a different provider's KSK. So it honestly doesn't matter which provider's nameservers the resolver gets the DNSKEY RRset from, because the signed DS record in each model can authenticate the matching KSK 🫶.

4. Signing-Algorithm Considerations

Providers taking part in multi-signer models need to use a common DNSSEC signing algorithm (or a common set of algorithms, if more than one is in use) 🔥. Why? The current specs say that if the DNSKEY RRset contains multiple algorithms, then the RRsets in the zone need to be signed with at least one DNSKEY of each algorithm, as described in [RFC4035], Section 2.2. If providers use different signing algorithms, that just can't be satisfied 😭.

5. Authenticated-Denial Considerations

Authenticated denial of existence lets a resolver validate that a record does not exist 🙈. To do this, an authoritative server includes signed NSEC (Section 3.1.3 of [RFC4035]) or NSEC3 (Section 7.2 of [RFC5155]) records in its response, and those records give cryptographic proof of the nonexistence. NSEC3 is an upgrade on NSEC: it offers opt-out for signing insecure delegations and adds a bit of protection against zone-enumeration attacks 🧐.

An authoritative server's response carrying records for authenticated denial is always self-contained. The receiving resolver doesn't need to send any extra queries to finish the proof of denial 🌈. Because of that, you don't need a rollover when switching between NSEC and NSEC3 for a signed zone ✨.

Since authenticated-denial responses are self-contained, different providers can use NSEC and NSEC3 to serve the same zone. Heads up though: doing that undoes the zone-enumeration protection that NSEC3 gives you, because an adversary can just query the providers that use NSEC and enumerate the whole zone easily 💀. A better setup is for multiple providers to use different authenticated denial-of-existence mechanisms that all still defend against zone enumeration. Examples are precomputed NSEC3, NSEC3 white lies [RFC7129], NSEC black lies [BLACKLIES], and so on. One thing to note: having multiple providers offer different authenticated-denial mechanisms may affect how well resolvers can make use of caching for negative responses 🍓.

5.1. Single Method

Usually the NSEC and NSEC3 methods get used exclusively, meaning no two servers use them at the same time for the same zone 💖. This setup is preferred, because its behavior is well defined and it's the closest match to current operational practice 🫶.

5.2. Mixing Methods

Compliant resolvers should be able to validate zone data even when different authoritative servers for the same zone respond with different authenticated-denial methods 🌸. You'll see this a lot when NSEC and NSEC3 are being switched, or when NSEC3PARAM gets updated.

Resolver software might be designed to handle a single transition between two authenticated-denial configurations more smoothly than a permanent setup with mixed methods 🦋. But a mixed setup can make caching on the resolver side less efficient, and the authoritative servers may see a higher number of queries 😭. This is especially worth thinking about in the context of "Aggressive Use of DNSSEC-Validated Cache" [RFC8198] 🧠.

If all providers can't be configured with the same authenticated-denial mechanism, it's recommended to keep the number of distinct configurations as low as feasible 🎀.

Also, note that NSEC3 configured on all providers but with different NSEC3PARAM values counts as a mixed setup 💅.

6. Key Rollover Considerations

The multiple-signer models (Section 2.1) bring some new requirements for DNSSEC key rollovers 🔄. Since rollovers always involve coordinated actions from the providers and the zone owner, a reasonable strategy is for the zone owner to kick off key-rollover operations 👑. Other operationally plausible models can work too, though. For example, a DNS provider could start a key rollover and signal its intent to the zone owner somehow 🧚. That signal could travel over a secure out-of-band channel that both sides agreed on, or the provider could offer an API function that the zone owner polls periodically 🌈.

For simplicity, the descriptions in this section assume two DNS providers. They also assume that KSK rollovers use the commonly used Double-Signature KSK rollover method, and that ZSK rollovers use the Pre-Publish ZSK rollover method, as described in detail in [RFC6781] 💜. With minor changes, they can be adapted to other models, like Double-DS KSK rollover or Double-Signature ZSK rollover, if you want ✨. Key-use timing should follow the recommendations in [RFC6781], but you also have to account for the extra operations the multi-signer models need. For example, "time to propagate data to all the authoritative servers" now also includes the time to import the new ZSKs into each provider 🍓.

6.1. Model 1: Common KSK, Unique ZSK per Provider

Key Signing Key Rollover: In this model, the two managed-DNS providers share a common KSK (public key) in their zones, and the zone owner is the only one with access to the private key portion of the KSK 🔐. To start the rollover, the zone owner generates a new KSK and pulls the DNSKEY RRset from each DNS provider through their APIs 🫶. The new KSK gets added to each provider's DNSKEY RRset, and the RRset is re-signed with both the new and the old KSK 🌸. This new DNSKEY RRset is then transferred to each provider. Next, the zone owner updates the DS RRset in the parent zone to point to the new KSK. After the necessary DS record TTL period has passed, they go ahead and update the DNSKEY RRset to remove the old KSK 🦋.
Zone Signing Key Rollover: In this model, each DNS provider has its own Zone Signing Keys. Each provider can choose to roll its ZSK independently by coordinating with the zone owner 💖. Provider A generates a new ZSK and communicates its intent to do a rollover. (Heads up: Provider A can't immediately put this new ZSK into its DNSKEY RRset, because the RRset has to be signed by the zone owner 🙈.) The zone owner gets the new ZSK from Provider A. Then they pull the current DNSKEY RRset from each provider (including Provider A), insert the new ZSK into each DNSKEY RRset, re-sign the DNSKEY RRset, and send it back to each provider for deployment through their respective key-management APIs 🎀. Once the necessary time has elapsed (meaning all zone data has been re-signed by the new ZSK and propagated to all authoritative servers for the zone, plus the maximum zone-TTL value of any data in the zone that was signed by the old ZSK) ⏳, Provider A and the zone owner can start the next phase, which removes the old ZSK and re-signs the resulting new DNSKEY RRset 🧚.

6.2. Model 2: Unique KSK and ZSK per Provider

Key Signing Key Rollover: In Model 2, each managed-DNS provider has its own KSK. A KSK roll for Provider A doesn't require any change to Provider B's DNSKey RRset, but it does need coordination with the zone owner so the DS record set in the parent zone can get updated 🌈. The KSK roll starts with Provider A generating a new KSK and including it in its DNSKey RRset. The DNSKey RRset then gets signed by both the new and old KSK 💅. Provider A communicates the new KSK to the zone owner, who then updates the DS RRset to replace the DS record for the old KSK with a DS record for the new KSK 🫶. After the necessary DS RRset TTL period has passed, the old KSK can be removed from Provider A's DNSKey RRset 🦋.
Zone Signing Key Rollover: In Model 2, each managed-DNS provider has its own ZSK. The ZSK roll for Provider A starts with them generating a new ZSK, adding it to their DNSKey RRset, and re-signing the new DNSKey RRset with their KSK 🔥. Provider A then communicates its new ZSK to the zone owner, who starts the process of importing that ZSK into the DNSKey RRsets of the other providers, using their respective APIs 🌸. Before signing zone data with the new ZSK, Provider A should wait for the DNSKEY TTL, plus the time to import the ZSK into Provider B, plus the time to propagate the DNSKey RRset to all authoritative servers of both providers ⏳. Once the necessary Pre-Publish key-rollover time periods have elapsed, Provider A and the zone owner can start the process of removing the old ZSK from the DNSKey RRsets of all providers 👑.

7. Using Combined Signing Keys ✨

Okay bestie, so a Combined Signing Key (CSK) is one key doing EVERYTHING 💅. It's the secure entry point (SEP) key for the zone AND it signs all the zone data, DNSKEY RRset included. No KSK/ZSK split. Lowkey so clean 🧚

Model 1 is not compatible with CSKs 💀. The zone owner would be holding the only signing key, so the providers couldn't sign their own zone data. Not it 🙈

Model 2 can handle CSKs no cap 🫶. Any or all of the providers could use a CSK. The DS record in the parent zone would reference the provider's CSK instead of a KSK, and the public CSK would need to be imported into the DNSKEY RRsets of all the other providers.

Here's how a CSK rollover goes for one of these providers 🔁:

The provider generates a new CSK, installs it into the DNSKEY RRset, and signs the DNSKEY RRset with both the old and new CSKs.
The new CSK gets communicated to the zone owner.
The zone owner exports this CSK into the other providers' DNSKEY RRsets, and replaces the DS record referencing the old CSK with one referencing the new CSK in the parent DS RRset.
Once all the zone data has been re-signed with the new CSK, the old CSK comes out of the DNSKEY RRset, and the DNSKEY RRset gets re-signed with only the new CSK.
Finally, the old CSK is removed from the DNSKEY RRsets of the other providers.

8. Use of CDS and CDNSKEY 🦋

CDS and CDNSKEY records [RFC7344][RFC8078] are used to facilitate automated updates of DNSSEC secure-entry-point keys between parent and child zones. Multi-signer DNSSEC configurations can support this too 🙌.

In Model 1, CDS/CDNSKEY changes are centralized at the zone owner. However, the zone owner will still need to push down updated signed CDNS/DNSKEY RRsets to the providers via the key-management mechanism.

In Model 2, the key-management mechanism needs to support cross-importation of the CDS/CDNSKEY records. That way a common view of the RRset can be built at each provider, and it's visible to the parent zone when it tries to update the DS RRset 👀.

9. Key-Management-Mechanism Requirements 🔐

Managed-DNS providers usually have their own proprietary zone configuration and data-management APIs, commonly using HTTPS and Representational State Transfer (REST) interfaces. So instead of inventing a brand new API for key management here, we describe the specific functions the provider API needs to support in order to enable the multi-signer models 💖. The zone owner is expected to use these API functions to do the key-management tasks. Other mechanisms that can partly offer these functions, if the providers support them, include the DNS UPDATE protocol [RFC2136] and Extensible Provisioning Protocol (EPP) [RFC5731].

The API must offer a way to query the current DNSKEY RRset of the provider.
For Model 1, the API must offer a way to import a signed DNSKEY RRset and replace the current one at the provider. Additionally, if CDS/CDNSKEY is supported, the API must also offer a way to import a signed CDS/CDNSKEY RRset.
For Model 2, the API must offer a way to import a DNSKEY record from an external provider into the current DNSKEY RRset. Additionally, if CDS/CDNSKEY is supported, the API must offer a mechanism to import individual CDS/CDNSKEY records from an external provider.

In Model 2, once the providers have been initially bootstrapped with each other's zone-signing keys through these API mechanisms, they could, if they want, periodically query each other's DNSKEY RRsets, authenticate their signatures, and automatically import or withdraw ZSKs in the keyset as key-rollover events happen 🔄✨.

10. DNS Response-Size Considerations 📦

The multi-signer models result in larger DNSKEY RRsets, so a response to a query for the DNSKEY RRset will be bigger 📈. The actual size increase depends on multiple factors: DNSKEY algorithm and keysize choices, the number of providers, whether additional keys are prepublished, how many simultaneous key rollovers are in progress, and so on.

Newer elliptic-curve algorithms produce keys small enough that the responses will typically be far below the common Internet-path MTU 🙌. So operational concerns related to IP fragmentation or truncation and TCP fallback are unlikely to come up. Still, DNS operators need to make sure they can emit and process large DNS UDP responses when necessary. A future migration to alternative transports like DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484] may make this whole topic moot 🌈.

11. IANA Considerations 🌸

This document has no IANA actions.

12. Security Considerations 🚨

The multi-signer models necessarily involve third-party providers holding the private keys that sign the zone owner's data. Obviously, this means the zone owner has decided to place a great deal of trust in these providers 😬.

By contrast, the more traditional model, where the zone owner runs a hidden master and uses the zone-transfer protocol with the providers, is arguably more secure 🔒. Only the zone owner holds the private signing keys, and the third-party providers cannot serve bogus data without detection by validating resolvers.

The zone-key import and export APIs required by these models need to be strongly authenticated to prevent tampering of key material by malicious third parties 🚫. Many providers today offer REST/HTTPS APIs that use a number of client-authentication mechanisms (username/password, API keys, etc.), and whose HTTPS layer provides transport security and server authentication. Multifactor authentication could be used to strengthen security even further 🛡️.

If DNS protocol mechanisms like UPDATE are being used for key insertion and deletion, they should similarly be strongly authenticated, e.g., by employing Transaction Signatures (TSIG) [RFC2845]. Key generation and other general security-related operations should follow the guidance specified in [RFC6781]. Please don't skip this part, bestie 🥺.

13. References 📚

13.1. Normative References

[RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
           STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
           <https://www.rfc-editor.org/info/rfc1034>.

[RFC1035]  Mockapetris, P., "Domain names - implementation and
           specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
           November 1987, <https://www.rfc-editor.org/info/rfc1035>.

[RFC2845]  Vixie, P., Gudmundsson, O., Eastlake 3rd, D., and B.
           Wellington, "Secret Key Transaction Authentication for DNS
           (TSIG)", RFC 2845, DOI 10.17487/RFC2845, May 2000,
           <https://www.rfc-editor.org/info/rfc2845>.

[RFC4033]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "DNS Security Introduction and Requirements",
           RFC 4033, DOI 10.17487/RFC4033, March 2005,
           <https://www.rfc-editor.org/info/rfc4033>.

[RFC4034]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Resource Records for the DNS Security Extensions",
           RFC 4034, DOI 10.17487/RFC4034, March 2005,
           <https://www.rfc-editor.org/info/rfc4034>.

[RFC4035]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Protocol Modifications for the DNS Security
           Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005,
           <https://www.rfc-editor.org/info/rfc4035>.

[RFC5155]  Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNS
           Security (DNSSEC) Hashed Authenticated Denial of
           Existence", RFC 5155, DOI 10.17487/RFC5155, March 2008,
           <https://www.rfc-editor.org/info/rfc5155>.

[RFC6781]  Kolkman, O., Mekking, W., and R. Gieben, "DNSSEC
           Operational Practices, Version 2", RFC 6781,
           DOI 10.17487/RFC6781, December 2012,
           <https://www.rfc-editor.org/info/rfc6781>.

[RFC7344]  Kumari, W., Gudmundsson, O., and G. Barwood, "Automating
           DNSSEC Delegation Trust Maintenance", RFC 7344,
           DOI 10.17487/RFC7344, September 2014,
           <https://www.rfc-editor.org/info/rfc7344>.

[RFC8078]  Gudmundsson, O. and P. Wouters, "Managing DS Records from
           the Parent via CDS/CDNSKEY", RFC 8078,
           DOI 10.17487/RFC8078, March 2017,
           <https://www.rfc-editor.org/info/rfc8078>.

[RFC8198]  Fujiwara, K., Kato, A., and W. Kumari, "Aggressive Use of
           DNSSEC-Validated Cache", RFC 8198, DOI 10.17487/RFC8198,
           July 2017, <https://www.rfc-editor.org/info/rfc8198>.

13.2. Informative References

[BLACKLIES]
           Valsorda, F. and O. Gudmundsson, "Compact DNSSEC Denial of
           Existence or Black Lies", Work in Progress, Internet-
           Draft, draft-valsorda-dnsop-black-lies-00, 21 March 2016,
           <https://tools.ietf.org/html/draft-valsorda-dnsop-black-
           lies-00>.

[RFC1995]  Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995,
           DOI 10.17487/RFC1995, August 1996,
           <https://www.rfc-editor.org/info/rfc1995>.

[RFC2136]  Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,
           "Dynamic Updates in the Domain Name System (DNS UPDATE)",
           RFC 2136, DOI 10.17487/RFC2136, April 1997,
           <https://www.rfc-editor.org/info/rfc2136>.

[RFC5731]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
           Domain Name Mapping", STD 69, RFC 5731,
           DOI 10.17487/RFC5731, August 2009,
           <https://www.rfc-editor.org/info/rfc5731>.

[RFC5936]  Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol
           (AXFR)", RFC 5936, DOI 10.17487/RFC5936, June 2010,
           <https://www.rfc-editor.org/info/rfc5936>.

[RFC7129]  Gieben, R. and W. Mekking, "Authenticated Denial of
           Existence in the DNS", RFC 7129, DOI 10.17487/RFC7129,
           February 2014, <https://www.rfc-editor.org/info/rfc7129>.

[RFC7858]  Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D.,
           and P. Hoffman, "Specification for DNS over Transport
           Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May
           2016, <https://www.rfc-editor.org/info/rfc7858>.

[RFC8484]  Hoffman, P. and P. McManus, "DNS Queries over HTTPS
           (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,
           <https://www.rfc-editor.org/info/rfc8484>.

[RFC8499]  Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS
           Terminology", BCP 219, RFC 8499, DOI 10.17487/RFC8499,
           January 2019, <https://www.rfc-editor.org/info/rfc8499>.

Acknowledgments 🫶

The initial version of this document benefited from discussions with and review from Duane Wessels. Additional helpful comments were provided by Steve Crocker, Ulrich Wisser, Tony Finch, Olafur Gudmundsson, Matthijs Mekking, Daniel Migault, and Ben Kaduk. Thank you, legends 👑💜.

Authors' Addresses 🎀

Shumon Huque
Salesforce
415 Mission Street, 3rd Floor
San Francisco, CA 94105
United States of America

Email: shuque@gmail.com


Pallavi Aras
Salesforce
415 Mission Street, 3rd Floor
San Francisco, CA 94105
United States of America

Email: paras@salesforce.com


John Dickinson
Sinodun IT
Magdalen Centre
Oxford Science Park
Oxford
OX4 4GA
United Kingdom

Email: jad@sinodun.com


Jan Vcelak
NS1
55 Broad Street, 19th Floor
New York, NY 10004
United States of America

Email: jvcelak@ns1.com


David Blacka
Verisign
12061 Bluemont Way
Reston, VA 20190
United States of America

Email: davidb@verisign.com

📦 where this page comes from

ietf: rfc8901 2020-09
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms