[dns-operations] Question about DNSSEC algorithm support in domain registries, registrars

[Iliya Bazlyankov]

Hi Joe, all,

To contribute another data point to the survey, both our open-source
projects, Namingo Registry and Namingo Registrar, support DNSSEC algorithms
17 (SM2/SM3) and 18 (ML-DSA-44), as well as DS digest type 6 (SM3), for
DNSSEC delegation management via EPP.

While this does not reflect the policies of individual TLDs, I thought it
would be useful to share that support is already available on both the
registry and registrar software sides.

Both projects are available at https://namingo.org.

Best regards,
Iliya Bazlyankov

On Wed, Oct 14, 2026 at 11:00 AM Joe Abley via dns-operations <
dns-operations at dns-oarc.net> wrote:

>
>
>
> ---------- Forwarded message ----------
> From: Joe Abley <jabley at strandkip.nl>
> To: Joe Abley via dns-operations <dns-operations at dns-oarc.net>
> Cc:
> Bcc:
> Date: Wed, 14 Oct 2026 09:48:59 +0200
> Subject: Question about DNSSEC algorithm support in domain registries,
> registrars
> Hi all,
>
> I am trying to build a picture of DNSSEC algorithm support in domain
> registries. This is motivated by some recent work at Cloudflare with the
> newly-minted, post-quantum algorithm 18, ML-DSA-44. [1]
>
> The particular corner of the picture I'm interested in is the EPP part --
> the part where a domain registrant arranges for their registrar to send
> information about their KSK to the relevant TLD registry, so that it can be
> used to secure the delegation from the TLD zone to the child zone with a DS
> RRSet.
>
> There are quite a number of TLDs I have found that constrain the values
> allowed in the Algorithm field [2] according to some interpretation of what
> is "standard" or "recommended". It feels like there is some ambiguity
> around this, which seems like an opportunity to propose some clarity. The
> first step is understanding the current situation.
>
> Algorithm 18 (the motivation to look) appears in the IANA registry as MAY
> be used for signing [3] but I have not yet found a registrar-registry
> combination that will allow a registrant to use it. I have also not found a
> good description of what is allowed for most TLDs, so it's very possible
> that a combination exists and I just haven't found it.
>
> An example of policy implemented by a TLD can be found in Nominet's
> published resources for registrars [4] which confirms that the supported
> algorithms for domains registered in the UK registry are 3, 5, 6, 7, 8, 10,
> 12, 13, 14, 15, and 16. (It's great that this information is so clear and
> easy to find! Thank you, Nominet.)
>
> If you are a TLD (g or cc or any other flavour) registrar or a registry
> operator and you know what your policy is for your TLDs, could you drop me
> a note and let me know? Off-list is fine, and I can summarise if there is
> interest in the results. If you have a link to a public reference that
> would be outstanding.
>
> If you are on other mailing lists where TLD registry operators are known
> to lurk, please feel free to forward! That would be great.
>
>
> Joe
>
> [1] https://datatracker.ietf.org/doc/draft-westerbaan-dnssec-mldsa/
> [2] https://www.rfc-editor.org/info/rfc4034/#section-5
> [3]
> https://www.iana.org/assignments/dns-sec-alg-numbers#dns-sec-alg-numbers-1
> [4] https://registrars.nominet.uk/gtlds/gtld-registrar-systems/dnssec/
>
>
>
> ---------- Forwarded message ----------
> From: Joe Abley via dns-operations <dns-operations at dns-oarc.net>
> To: Joe Abley via dns-operations <dns-operations at dns-oarc.net>
> Cc:
> Bcc:
> Date: Wed, 14 Oct 2026 09:48:59 +0200
> Subject: [dns-operations] Question about DNSSEC algorithm support in
> domain registries, registrars
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20261014/57c01470/attachment.html>