[dns-operations] Enhancements to DNSSEC validation for the DNS Root Zone change requests

[Kim Davies]

Dear colleagues,

We are proposing to augment the technical tests that are performed when we process changes to the DNS root zone for top-level domain operators. Specifically, we plan on performing RRSIG checking in addition to checking the proposed DS record(s) have matching DNSKEY records. This change is based on observations that some TLD operators have had authorities that did not correctly support DNSSEC when they have asked for DS records to be listed in the root zone.

More details on this have been posted on the joint Root DNSSEC website at http://www.root-dnssec.org/2011/01/27/rrsig-checking/

Please let us know if you have any comments or concerns.

cheers,

Kim Davies
Manager, Root Zone Services
ICANN
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20110128/3ccba72b/attachment.html>