Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 5
Abstract: This document deprecates the use of the RSASHA1 and RSASHA1-NSEC3-SHA1 algorithms for the creation of DNS Public Key (DNSKEY) and Resource Record Signature (RRSIG) records. It updates RFCs 4034 and 5155 as it deprecates the use of these algorithms.
Publication Date: 2025-11-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9905
Link: https://doi.org/10.17487/RFC9905
Author(s): Wes Hardaker
Warren Kumari
Keyword(s): DNS, DNSSEC, Key Rollover, Algorithm Agility, Algorithm, SHA-1

Latest version of IETF RFC 9905

Document Versions — IETF RFC 9905

▶ IETF RFC 9905 (2025-11-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IANA, "Digest Algorithms", <http://www.iana.org/assignments/ds-rr-types>. EXTERNAL
IANA, "DNS Security Algorithm Numbers", <https://www.iana.org/assignments/dns-sec-alg-numbers>. EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 3110 [Active*]
IETF RFC 3174 [Active, Amended*]
IETF RFC 4034 [Active*]
RFC5155 — RFC5155 EXTERNAL
IETF RFC 8174 [Active*]
RFC9364 — RFC9364 EXTERNAL
IETF RFC 9499 [Active*]
IETF RFC 9904 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9905.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9905, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms. Available at https://doi.org/10.17487/RFC9905

Snippet:

IETF RFC 9905, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms. Available at https://doi.org/10.17487/RFC9905

HTML (ISO 690 compliant)

Preview:

IETF RFC 9905, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms. Available at https://doi.org/10.17487/RFC9905

Snippet:

<span class="citation"><cite>IETF RFC 9905</cite>, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms. Available at <a href="https://doi.org/10.17487/RFC9905" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9905</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9905, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms
doi: 10.17487/RFC9905
url: https://doi.org/10.17487/RFC9905

Snippet:

<li>
<cite id="bib-rfc9905">IETF RFC 9905</cite>, Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms
<span class="doi">10.17487/RFC9905</span>
</li>