[dns-operations] Question about DNSSEC algorithm support in domain registries, registrars

[Frederico A C Neves]

Joe,

On Wed, Oct 14, 2026 at 09:48:59AM +0200, Joe Abley via dns-operations wrote:
> Date: Wed, 14 Oct 2026 09:48:59 +0200
> From: Joe Abley <jabley at strandkip.nl>
> To: Joe Abley via dns-operations <dns-operations at dns-oarc.net>
> Subject: Question about DNSSEC algorithm support in domain registries,
>  registrars
>
> Hi all,
>
> I am trying to build a picture of DNSSEC algorithm support in domain registries. This is motivated by some recent work at Cloudflare with the newly-minted, post-quantum algorithm 18, ML-DSA-44. [1]
>
> The particular corner of the picture I'm interested in is the EPP part -- the part where a domain registrant arranges for their registrar to send information about their KSK to the relevant TLD registry, so that it can be used to secure the delegation from the TLD zone to the child zone with a DS RRSet.
>
> There are quite a number of TLDs I have found that constrain the values allowed in the Algorithm field [2] according to some interpretation of what is "standard" or "recommended". It feels like there is some ambiguity around this, which seems like an opportunity to propose some clarity. The first step is understanding the current situation.
>
> Algorithm 18 (the motivation to look) appears in the IANA registry as MAY be used for signing [3] but I have not yet found a registrar-registry combination that will allow a registrant to use it. I have also not found a good description of what is allowed for most TLDs, so it's very possible that a combination exists and I just haven't found it.
>
> An example of policy implemented by a TLD can be found in Nominet's published resources for registrars [4] which confirms that the supported algorithms for domains registered in the UK registry are 3, 5, 6, 7, 8, 10, 12, 13, 14, 15, and 16. (It's great that this information is so clear and easy to find! Thank you, Nominet.)
>

When you don't test and your customer shoot himself in the foot your
customer service suffers, when you do test but don't support all
possible algorithms your customer service suffers as well ;-)

Until 6 months ago we supported 5,7,8,10,13,14,15,16 and still have
~1k delegations with 5,7. We don't allow new DSs of 5,7 anymore. We
will definitely support PQC algos in the future.

Fred

> If you are a TLD (g or cc or any other flavour) registrar or a registry operator and you know what your policy is for your TLDs, could you drop me a note and let me know? Off-list is fine, and I can summarise if there is interest in the results. If you have a link to a public reference that would be outstanding.
>
> If you are on other mailing lists where TLD registry operators are known to lurk, please feel free to forward! That would be great.
>
>
> Joe
>
> [1] https://datatracker.ietf.org/doc/draft-westerbaan-dnssec-mldsa/
> [2] https://www.rfc-editor.org/info/rfc4034/#section-5
> [3] https://www.iana.org/assignments/dns-sec-alg-numbers#dns-sec-alg-numbers-1
> [4] https://registrars.nominet.uk/gtlds/gtld-registrar-systems/dnssec/