Network Working Group R. Arends Request for Comments: 4034 Telematica Instituut Obsoletes: 2535, 3008, 3090, 3445, 3655, 3658, R. Austein 3755, 3757, 3845 ISC Updates: 1034, 1035, 2136, 2181, 2308, 3225, M. Larson 3007, 3597, 3226 VeriSign Category: Standards Track D. Massey Colorado State University S. Rose NIST March 2005Resource Records for the DNS Security Extensions
Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2005). Abstract This document is part of a family of documents that describe the DNS Security Extensions (DNSSEC). The DNS Security Extensions are a collection of resource records and protocol modifications that provide source authentication for the DNS. This document defines the public key (DNSKEY), delegation signer (DS), resource record digital signature (RRSIG), and authenticated denial of existence (NSEC) resource records. The purpose and format of each resource record is described in detail, and an example of each resource record is given. This document obsoletes RFC 2535 and incorporates changes from all updates to RFC 2535. Arends, et al. Standards Track [Page 1]
RFC 4034 DNSSEC Resource Records March 2005 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Background and Related Documents . . . . . . . . . . . 3 1.2. Reserved Words . . . . . . . . . . . . . . . . . . . . 3 2. The DNSKEY Resource Record . . . . . . . . . . . . . . . . . 4 2.1. DNSKEY RDATA Wire Format . . . . . . . . . . . . . . . 4 2.1.1. The Flags Field. . . . . . . . . . . . . . . . 4 2.1.2. The Protocol Field . . . . . . . . . . . . . . 5 2.1.3. The Algorithm Field. . . . . . . . . . . . . . 5 2.1.4. The Public Key Field . . . . . . . . . . . . . 5 2.1.5. Notes on DNSKEY RDATA Design . . . . . . . . . 5 2.2. The DNSKEY RR Presentation Format. . . . . . . . . . . 5 2.3. DNSKEY RR Example . . . . . . . . . . . . . . . . . . 6 3. The RRSIG Resource Record . . . . . . . . . . . . . . . . . 6 3.1. RRSIG RDATA Wire Format. . . . . . . . . . . . . . . . 7 3.1.1. The Type Covered Field . . . . . . . . . . . . 7 3.1.2. The Algorithm Number Field . . . . . . . . . . 8 3.1.3. The Labels Field . . . . . . . . . . . . . . . 8 3.1.4. Original TTL Field . . . . . . . . . . . . . . 8 3.1.5. Signature Expiration and Inception Fields. . . 9 3.1.6. The Key Tag Field. . . . . . . . . . . . . . . 9 3.1.7. The Signer's Name Field. . . . . . . . . . . . 9 3.1.8. The Signature Field. . . . . . . . . . . . . . 9 3.2. The RRSIG RR Presentation Format . . . . . . . . . . . 10 3.3. RRSIG RR Example . . . . . . . . . . . . . . . . . . . 11 4. The NSEC Resource Record . . . . . . . . . . . . . . . . . . 12 4.1. NSEC RDATA Wire Format . . . . . . . . . . . . . . . . 13 4.1.1. The Next Domain Name Field . . . . . . . . . . 13 4.1.2. The Type Bit Maps Field. . . . . . . . . . . . 13 4.1.3. Inclusion of Wildcard Names in NSEC RDATA. . . 14 4.2. The NSEC RR Presentation Format. . . . . . . . . . . . 14 4.3. NSEC RR Example. . . . . . . . . . . . . . . . . . . . 15 5. The DS Resource Record . . . . . . . . . . . . . . . . . . . 15 5.1. DS RDATA Wire Format . . . . . . . . . . . . . . . . . 16 5.1.1. The Key Tag Field. . . . . . . . . . . . . . . 16 5.1.2. The Algorithm Field. . . . . . . . . . . . . . 16 5.1.3. The Digest Type Field. . . . . . . . . . . . . 17 5.1.4. The Digest Field . . . . . . . . . . . . . . . 17 5.2. Processing of DS RRs When Validating Responses . . . . 17 5.3. The DS RR Presentation Format. . . . . . . . . . . . . 17 5.4. DS RR Example. . . . . . . . . . . . . . . . . . . . . 18 6. Canonical Form and Order of Resource Records . . . . . . . . 18 6.1. Canonical DNS Name Order . . . . . . . . . . . . . . . 18 6.2. Canonical RR Form. . . . . . . . . . . . . . . . . . . 19 6.3. Canonical RR Ordering within an RRset. . . . . . . . . 20 7. IANA Considerations. . . . . . . . . . . . . . . . . . . . . 20 8. Security Considerations. . . . . . . . . . . . . . . . . . . 21 Arends, et al. Standards Track [Page 2]
RFC 4034 DNSSEC Resource Records March 2005 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 22 10.1. Normative References . . . . . . . . . . . . . . . . . 22 10.2. Informative References . . . . . . . . . . . . . . . . 23 A. DNSSEC Algorithm and Digest Types. . . . . . . . . . . . . . 24 A.1. DNSSEC Algorithm Types . . . . . . . . . . . . . . . . 24 A.1.1. Private Algorithm Types. . . . . . . . . . . . 25 A.2. DNSSEC Digest Types. . . . . . . . . . . . . . . . . . 25 B. Key Tag Calculation. . . . . . . . . . . . . . . . . . . . . 25 B.1. Key Tag for Algorithm 1 (RSA/MD5). . . . . . . . . . . 27 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 28 Full Copyright Statement . . . . . . . . . . . . . . . . . . . . 291. Introduction
The DNS Security Extensions (DNSSEC) introduce four new DNS resource record types: DNS Public Key (DNSKEY), Resource Record Signature (RRSIG), Next Secure (NSEC), and Delegation Signer (DS). This document defines the purpose of each resource record (RR), the RR's RDATA format, and its presentation format (ASCII representation).1.1. Background and Related Documents
This document is part of a family of documents defining DNSSEC, which should be read together as a set. [RFC4033] contains an introduction to DNSSEC and definition of common terms; the reader is assumed to be familiar with this document. [RFC4033] also contains a list of other documents updated by and obsoleted by this document set. [RFC4035] defines the DNSSEC protocol operations. The reader is also assumed to be familiar with the basic DNS concepts described in [RFC1034], [RFC1035], and the subsequent documents that update them, particularly [RFC2181] and [RFC2308]. This document defines the DNSSEC resource records. All numeric DNS type codes given in this document are decimal integers.1.2. Reserved Words
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Arends, et al. Standards Track [Page 3]
RFC 4034 DNSSEC Resource Records March 2005