[dns-operations] Question about DNSSEC algorithm support in domain registries, registrars

[Joe Abley]

Hi again,

Replying gratuitously to myself in the honoured tradition:

On 14 Oct 2026, at 09:48, Joe Abley via dns-operations <dns-operations at dns-oarc.net> wrote:

> I am trying to build a picture of DNSSEC algorithm support in domain registries. This is motivated by some recent work at Cloudflare with the newly-minted, post-quantum algorithm 18, ML-DSA-44. [1]
> 
> The particular corner of the picture I'm interested in is the EPP part -- the part where a domain registrant arranges for their registrar to send information about their KSK to the relevant TLD registry, so that it can be used to secure the delegation from the TLD zone to the child zone with a DS RRSet.
> 
> There are quite a number of TLDs I have found that constrain the values allowed in the Algorithm field [2] according to some interpretation of what is "standard" or "recommended". It feels like there is some ambiguity around this, which seems like an opportunity to propose some clarity. The first step is understanding the current situation.

Small update for those who are interested, since I got quite a few replies off-list as well as those you have seen here.

Thanks everybody who took the time to send me things!

I think it's clear that

(a) we have a bunch of registry operators who follow this list, and wonderful people you all are, too

(b) there is variation in what is allowed

(c) mostly, these details are not published

(d) there is friction for new signing algorithms, since pretty much everybody operates with an allowlist that blocks new things by default.

I wrote up some ideas about how to make this better which I have circulated amongst regext people. If anybody here has an opinion about this (or feels moved to say something on the regext list) I would be very happy to receive reviews.

https://datatracker.ietf.org/doc/draft-jabley-regext-allowable-dnssec-parameters/


Joe