API Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 8078
[ACTIVE]

Managing DS Records from the Parent via CDS/CDNSKEY

Metadata

Publisher
IETF
Doc Type
Standard
Pages
10
Abstract
RFC 7344 specifies how DNS trust can be maintained across key rollovers in-band between parent and child. This document elevates RFC 7344 from Informational to Standards Track. It also adds a method for initial trust setup and removal of a secure entry point. Changing a domain's DNSSEC status can be a complicated matter involving multiple unrelated parties. Some of these parties, such as the DNS operator, might not even be known by all the organizations involved. The inability to disable DNSSEC via in-band signaling is seen as a problem or liability that prevents some DNSSEC adoption at a large scale. This document adds a method for in-band signaling of these DNSSEC status changes. This document describes reasonable policies to ease deployment of the initial acceptance of new secure entry points (DS records). It is preferable that operators collaborate on the transfer or move of a domain. The best method is to perform a Key Signing Key (KSK) plus Zone Signing Key (ZSK) rollover. If that is not possible, the method using an unsigned intermediate state described in this document can be used to move the domain between two parties. This leaves the domain temporarily unsigned and vulnerable to DNS spoofing, but that is preferred over the alternative of validation failures due to a mismatched DS and DNSKEY record.
Publication Date
2017-03-01
Status Note
Proposed Standard
DOI
10.17487/RFC8078
Link
https://doi.org/10.17487/RFC8078
Author(s)
Ólafur Guðmundsson
Paul Wouters
Keyword(s)
DNSSEC, Trust Maintenance
Latest version of IETF RFC 8078

Document Versions — IETF RFC 8078

  • ▶ IETF RFC 8078 (2017-03-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8078.json

Amends:
IETF RFC 7344 [Active*]
Amended by:
IETF RFC 9615 [Active*]

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 8078, Managing DS Records from the Parent via CDS/CDNSKEY. Available at https://doi.org/10.17487/RFC8078
Snippet:
IETF RFC 8078, Managing DS Records from the Parent via CDS/CDNSKEY. Available at https://doi.org/10.17487/RFC8078

HTML (ISO 690 compliant)

Preview:
IETF RFC 8078, Managing DS Records from the Parent via CDS/CDNSKEY. Available at https://doi.org/10.17487/RFC8078
Snippet:
<span class="citation"><cite>IETF RFC 8078</cite>, Managing DS Records from the Parent via CDS/CDNSKEY. Available at <a href="https://doi.org/10.17487/RFC8078" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8078</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 8078, Managing DS Records from the Parent via CDS/CDNSKEY
doi: 10.17487/RFC8078
url: https://doi.org/10.17487/RFC8078
Snippet:
<li>
<cite id="bib-rfc8078">IETF RFC 8078</cite>, Managing DS Records from the Parent via CDS/CDNSKEY
<span class="doi">10.17487/RFC8078</span>
</li>

Referenced By