Question about DNSSEC algorithm support in domain registries, registrars

[Joe Abley]

Hi all,

I am trying to build a picture of DNSSEC algorithm support in domain registries. This is motivated by some recent work at Cloudflare with the newly-minted, post-quantum algorithm 18, ML-DSA-44. [1]

The particular corner of the picture I'm interested in is the EPP part -- the part where a domain registrant arranges for their registrar to send information about their KSK to the relevant TLD registry, so that it can be used to secure the delegation from the TLD zone to the child zone with a DS RRSet.

There are quite a number of TLDs I have found that constrain the values allowed in the Algorithm field [2] according to some interpretation of what is "standard" or "recommended". It feels like there is some ambiguity around this, which seems like an opportunity to propose some clarity. The first step is understanding the current situation.

Algorithm 18 (the motivation to look) appears in the IANA registry as MAY be used for signing [3] but I have not yet found a registrar-registry combination that will allow a registrant to use it. I have also not found a good description of what is allowed for most TLDs, so it's very possible that a combination exists and I just haven't found it.

An example of policy implemented by a TLD can be found in Nominet's published resources for registrars [4] which confirms that the supported algorithms for domains registered in the UK registry are 3, 5, 6, 7, 8, 10, 12, 13, 14, 15, and 16. (It's great that this information is so clear and easy to find! Thank you, Nominet.)

If you are a TLD (g or cc or any other flavour) registrar or a registry operator and you know what your policy is for your TLDs, could you drop me a note and let me know? Off-list is fine, and I can summarise if there is interest in the results. If you have a link to a public reference that would be outstanding.

If you are on other mailing lists where TLD registry operators are known to lurk, please feel free to forward! That would be great.


Joe

[1] https://datatracker.ietf.org/doc/draft-westerbaan-dnssec-mldsa/
[2] https://www.rfc-editor.org/info/rfc4034/#section-5
[3] https://www.iana.org/assignments/dns-sec-alg-numbers#dns-sec-alg-numbers-1
[4] https://registrars.nominet.uk/gtlds/gtld-registrar-systems/dnssec/