IETF RFC 7646
[ACTIVE]
Definition and Use of DNSSEC Negative Trust Anchors
Metadata
- Publisher
- IETF
- Doc Type
- Informational
- Pages
- 16
- Abstract
- DNS Security Extensions (DNSSEC) is now entering widespread deployment. However, domain signing tools and processes are not yet as mature and reliable as those for non-DNSSEC-related domain administration tools and processes. This document defines Negative Trust Anchors (NTAs), which can be used to mitigate DNSSEC validation failures by disabling DNSSEC validation at specified domains.
- Publication Date
- 2015-09-01
- Status Note
- Informational
- DOI
10.17487/RFC7646- Link
- https://doi.org/10.17487/RFC7646
- Author(s)
- P EbersmanWarren KumariChris GriffithsJason LivingoodRalf Weber
- Keyword(s)
- NTA, ISP, DNS, DNSSEC
Latest version of IETF RFC 7646
Document Versions — IETF RFC 7646
-
▶ IETF RFC 7646 (2015-09-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 2119 [Active*]
- IETF RFC 4033 [Active*]
- IETF RFC 5914 [Active*]
- IETF RFC 6781 [Active*]
Bibliographic Reference(s)
- IETF.draft-ietf-dnsop-edns-client-subnet-03 — CLIENT-SUBNET EXTERNAL
- Wijngaards, W., "Unbound: How to Turn Off DNSSEC", June 2010, < http://unbound.net/documentation/ howto_turnoff_dnssec.html >. EXTERNAL
- Weaver, N., Kreibich, C., Nechaev, B., and V. Paxson, "Implications of Netalyzr's DNS Measurements", Securing and Trusting Internet Names (SATIN), April 2011, < http://conferences.npl.co.uk/satin/presentations/ satin2011slides-Weaver.pdf >. EXTERNAL
- Alexa, "The top 500 sites on the web", < http://www.alexa.com/topsites >. EXTERNAL
- Comcast, "faa.gov Failing DNSSEC Validation (Fixed)", February 2013, < http://dns.comcast.net/index.php/entry/ faa-gov-failing-dnssec-validation-fixed >. EXTERNAL
- Mens, J., "Is my Web site being used via a DNSSEC- validator?", July 2012, < http://jpmens.net/2012/07/30/ is-my-web-site-being-used-via-dnssec-validator/ >. EXTERNAL
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC7646.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 7646, Definition and Use of DNSSEC Negative Trust Anchors. Available at https://doi.org/10.17487/RFC7646
Snippet:
IETF RFC 7646, Definition and Use of DNSSEC Negative Trust Anchors. Available at https://doi.org/10.17487/RFC7646
HTML (ISO 690 compliant)
Preview:
IETF RFC 7646, Definition and Use of DNSSEC Negative Trust Anchors. Available at https://doi.org/10.17487/RFC7646
Snippet:
<span class="citation"><cite>IETF RFC 7646</cite>, Definition and Use of DNSSEC Negative Trust Anchors. Available at <a href="https://doi.org/10.17487/RFC7646" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7646</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 7646, Definition and Use of DNSSEC Negative Trust Anchors
doi: 10.17487/RFC7646
url: https://doi.org/10.17487/RFC7646
doi: 10.17487/RFC7646
url: https://doi.org/10.17487/RFC7646
Snippet:
<li> <cite id="bib-rfc7646">IETF RFC 7646</cite>, Definition and Use of DNSSEC Negative Trust Anchors <span class="doi">10.17487/RFC7646</span> </li>
Referenced By
- IETF RFC 7901 [Active*]
- IETF RFC 9364 [Active*]