DNSSEC Cryptographic Algorithm Recommendation Update Process

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 13
Abstract: The DNSSEC protocol makes use of various cryptographic algorithms to provide authentication of DNS data and proof of nonexistence. To ensure interoperability between DNS resolvers and DNS authoritative servers, it is necessary to specify both a set of algorithm implementation requirements and usage guidelines to ensure that there is at least one algorithm that all implementations support. This document replaces and obsoletes RFC 8624 and moves the canonical source of algorithm implementation requirements and usage guidance for DNSSEC from RFC 8624 to the IANA DNSSEC algorithm registries. This is done to allow the list of requirements to be more easily updated and referenced. Extensions to these registries can be made in future RFCs. This document also updates RFC 9157 and incorporates the revised IANA DNSSEC considerations from that RFC. This document does not change the recommendation status (MUST, MAY, RECOMMENDED, etc.) of the algorithms listed in RFC 8624; that is the work of future documents.
Publication Date: 2025-11-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9904
Link: https://doi.org/10.17487/RFC9904
Author(s): Wes Hardaker
Warren Kumari
Keyword(s): DNS, DNSSEC, Key Rollover, Algorithm Agility

Latest version of IETF RFC 9904

Document Versions — IETF RFC 9904

▶ IETF RFC 9904 (2025-11-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IANA, "Digest Algorithms", <http://www.iana.org/assignments/ds-rr-types>. EXTERNAL
IANA, "DNS Security Algorithm Numbers", <https://www.iana.org/assignments/dns-sec-alg-numbers>. EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 8126 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 9157 [Active*]

Bibliographic Reference(s)

IANA, "Transport Layer Security (TLS) Parameters", <https://www.iana.org/assignments/tls-parameters>. EXTERNAL
IETF RFC 4034 [Active*]
RFC4509 — 20 EXTERNAL
RFC5155 — RFC5155 EXTERNAL
RFC5702 — RFC5702 EXTERNAL
RFC5933 — RFC5933 EXTERNAL
RFC6605 — RFC6605 EXTERNAL
IETF RFC 6781 [Active*]
RFC7583 — RFC7583 EXTERNAL
RFC8080 — RFC8080 EXTERNAL
IETF RFC 8624 [Superseded*]
RFC9364 — RFC9364 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9904.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9904, DNSSEC Cryptographic Algorithm Recommendation Update Process. Available at https://doi.org/10.17487/RFC9904

Snippet:

IETF RFC 9904, DNSSEC Cryptographic Algorithm Recommendation Update Process. Available at https://doi.org/10.17487/RFC9904

HTML (ISO 690 compliant)

Preview:

IETF RFC 9904, DNSSEC Cryptographic Algorithm Recommendation Update Process. Available at https://doi.org/10.17487/RFC9904

Snippet:

<span class="citation"><cite>IETF RFC 9904</cite>, DNSSEC Cryptographic Algorithm Recommendation Update Process. Available at <a href="https://doi.org/10.17487/RFC9904" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9904</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9904, DNSSEC Cryptographic Algorithm Recommendation Update Process
doi: 10.17487/RFC9904
url: https://doi.org/10.17487/RFC9904

Snippet:

<li>
<cite id="bib-rfc9904">IETF RFC 9904</cite>, DNSSEC Cryptographic Algorithm Recommendation Update Process
<span class="doi">10.17487/RFC9904</span>
</li>

Referenced By

IETF RFC 9905 [Active*]