[dns-operations] DNSSEC DS record generation for DOT-US from NSEC3 signed-zone

[Jason Roysdon]

I am working on getting my DS record added to the DOT-US zone with
Neustar.  In doing so, I found out they have a limitation of only
supporting algorithm 3, which is DSA/SHA1, or algorithm 5, which is
RSA/SHA1:
http://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml

They do not support algorithm 7, which is RSASHA1-NSEC3-SHA1.  So when I
sent them my DS keys, they added them as algorithm 3, which of course
didn't work and reported bogus DS records, so they pulled the record
back out (thanks, Andrew).

The problem I have is that my zone is using an NSEC3 and when BIND's
dnssec-signzone generates dsset files, it does so with algorithm 7.  How
can I generate DS records with NSEC3 keys, for algorithm 3 or 5 (NSEC)
as Neustar requires?

Thanks,

Jason Roysdon
http://jason.roysdon.net/