[dns-operations] Enhancements to DNSSEC validation for the DNS Root Zone change requests

Kim Davies kim.davies at icann.org
Fri Jan 28 18:18:46 UTC 2011

Dear colleagues,

We are proposing to augment the technical tests that are performed when we process changes to the DNS root zone for top-level domain operators. Specifically, we plan on performing RRSIG checking in addition to checking the proposed DS record(s) have matching DNSKEY records. This change is based on observations that some TLD operators have had authorities that did not correctly support DNSSEC when they have asked for DS records to be listed in the root zone.

More details on this have been posted on the joint Root DNSSEC website at http://www.root-dnssec.org/2011/01/27/rrsig-checking/

Please let us know if you have any comments or concerns.


Kim Davies
Manager, Root Zone Services
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20110128/3ccba72b/attachment.html>

More information about the dns-operations mailing list