NEWRFC 10023 and the _for-sale TXT record: what it means for DNS security Sponsored by

NEWRFC 10023 and the _for-sale TXT record: what it means for DNS security

DNSSEC Algorithm Strength Assessment

Critical evaluation of cryptographic algorithms protecting your DNS infrastructure

Warning Security Issue

DNSSEC Security

Cryptographic Assessment

Algorithm Security Warning

The cryptographic algorithms used in your DNSSEC implementation directly affect its security strength. As computing power increases and cryptographic research advances, previously secure algorithms can become vulnerable. This guide helps you assess and upgrade your DNSSEC algorithm choices to maintain robust protection.

Why DNSSEC Algorithm Choice Matters

DNSSEC uses cryptographic algorithms to generate digital signatures for DNS records. These signatures verify the authenticity and integrity of DNS data, preventing attacks like cache poisoning and DNS spoofing. However, not all algorithms provide the same level of security, and the landscape continues to evolve as computing power increases and cryptographic research advances.

Older algorithms like RSA/MD5 and DSA/SHA1 have known cryptographic weaknesses that make them vulnerable to modern attacks, while newer algorithms like ECDSA and EdDSA provide stronger security with smaller signatures, improving both security and performance. Algorithm transition requires careful planning to maintain compatibility while enhancing security.

Algorithm Security Classifications:

Deprecated algorithms including RSA/MD5 and DSA/SHA1 should be replaced immediately as they contain known vulnerabilities that sophisticated attackers can exploit to forge DNS signatures or compromise zone integrity.

Legacy algorithms like RSA/SHA-1 remain technically functional but should be upgraded during the next key rotation cycle as SHA-1 collision attacks become increasingly practical with modern computing resources.

Modern algorithms such as ECDSA P-256, ECDSA P-384, Ed25519, and Ed448 represent the current best practices for DNSSEC deployment, offering excellent security with efficient performance characteristics.

Upgrading Your DNSSEC Algorithm

Moving from vulnerable algorithms to modern ones requires a structured approach to avoid service disruptions. Upgrading your DNSSEC algorithm requires careful planning to maintain availability during the transition. Begin by checking resolver support for your target algorithm, as most modern resolvers support algorithms 8, 10, 13, and 15. The process involves generating new keys with stronger algorithms, running both old and new algorithms simultaneously during a transition period, and then removing the older keys once the upgrade is fully validated.

For new deployments, choose EdDSA algorithms like Ed25519 or Ed448 when possible, as they provide the best combination of security, performance, and resistance to implementation errors. Organizations with existing RSA/SHA-256 implementations should prioritize upgrading to ECDSA P-256 or Ed25519, while those still using deprecated algorithms like RSA/MD5 or DSA/SHA1 should treat upgrades as critical security incidents requiring immediate attention.

Algorithm Upgrade Priority:

🔴 Critical: Replace RSA/MD5 and DSA/SHA1 immediately
🟡 Important: Plan RSA/SHA-1 upgrade within next key rotation
🟢 Recommended: Upgrade RSA/SHA-256 to ECDSA P-256 or Ed25519
⭐ Best Practice: Use Ed25519 for all new implementations

DNSSEC Algorithm Implementation Guide

Once you've determined which algorithm upgrade is needed, the implementation process varies depending on your DNS server software. The following examples show how to properly configure modern DNSSEC algorithms across different platforms, ensuring both security and compatibility.

BIND Algorithm Upgrade

Generate Modern DNSSEC Keys

Create Ed25519 keys for both Zone Signing Key (ZSK) and Key Signing Key (KSK) using dnssec-keygen.

# Generate new Ed25519 Zone Signing Key (ZSK) - modern elliptic curve algorithm
dnssec-keygen -a ED25519 -n ZONE example.com          # -a ED25519: Use Ed25519 algorithm (15)
                                                       # -n ZONE: Generate zone key (not host key)

# Generate new Ed25519 Key Signing Key (KSK) - signs DNSKEY records
dnssec-keygen -a ED25519 -f KSK -n ZONE example.com   # -f KSK: Mark as Key Signing Key
                                                       # KSK signs DNSKEY records, ZSK signs zone data

Key separation: ZSK signs zone data records while KSK signs the DNSKEY records, enabling independent key rollover schedules.

BIND Zone Configuration

Configure the zone in named.conf with automatic DNSSEC key management and inline signing.

# Add to named.conf.local with automatic key management
zone "example.com" IN {
    type master;                           # Authoritative master zone
    file "/etc/bind/zones/example.com.zone";          # Zone data file location
    key-directory "/etc/bind/keys/example.com";       # DNSSEC key storage directory
    auto-dnssec maintain;                  # Automatic key rotation and signing
    inline-signing yes;                    # Sign zone dynamically (don't modify zone file)
    serial-update-method increment;        # Auto-increment serial on changes
};

Inline signing benefit: Maintains your original zone file unchanged while creating a dynamically signed version for serving.

Zone Signing with NSEC3

Sign the zone using NSEC3 for enhanced privacy and protection against zone enumeration attacks.

# Sign the zone with NSEC3 for enhanced privacy
dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) \
    -N INCREMENT \                        # -N INCREMENT: Update serial number
    -o example.com \                      # -o: Origin domain name
    -t \                                  # -t: Print timing statistics
    -3 salt \                             # -3: Use NSEC3 with salt (privacy protection)
    /etc/bind/zones/example.com.zone

NSEC3 advantage: Uses hashed names to prevent attackers from enumerating all records in your DNS zone.

Configuration Reload and Verification

Apply the new configuration and verify that DNSSEC keys are properly loaded and active.

# Reload configuration and verify keys
rndc reload example.com                    # Reload zone configuration
rndc dnssec -status example.com            # Check DNSSEC status and keys

Verification importance: Always confirm keys are loaded and zone is properly signed before proceeding with DS record updates.

Unbound DNSSEC Validation

Core DNSSEC Module Configuration

Enable DNSSEC validation with automatic trust anchor management and modern algorithm support.

# Unbound DNSSEC Validation with Modern Algorithm Support (unbound.conf)
server:
    # Enable DNSSEC validation module chain
    module-config: "validator iterator"               # Load validator before iterator module
    auto-trust-anchor-file: "/etc/unbound/keys/root.key"  # Automatic root key updates (RFC 5011)
    
    # Modern DNSSEC algorithm support
    trust-anchor-signaling: yes                       # Signal algorithm support (RFC 8145)
    aggressive-nsec: yes                              # Use NSEC/NSEC3 for negative caching (RFC 8198)

Trust anchor automation: RFC 5011 automatic updates prevent validation failures when root keys are rolled.

Algorithm Support and Validation Rules

Configure support for modern algorithms and set strict validation behavior for security.

    # Supported DNSSEC algorithms (algorithm numbers from IANA registry)
    supported-algorithms: 8,10,13,15,16               # 8:RSA/SHA-256, 10:RSA/SHA-512, 13:ECDSA-P256, 15:Ed25519, 16:Ed448
    
    # DNSSEC validation behavior
    val-clean-additional: yes                         # Remove unsigned data from additional section
    val-permissive-mode: no                           # Strict validation (fail on bogus)
    val-log-level: 1                                  # Log validation failures (0=off, 1=minimal, 2=detailed)
    val-nsec3-keysize-iterations: 1024 150            # NSEC3 iteration limits (key-size iterations)

Strict validation: Permissive mode disabled ensures bogus signatures cause resolution failures rather than silent bypasses.

Performance Optimization

Optimize cache sizes for modern algorithms that use smaller key sizes but require efficient validation.

    # Performance optimization for modern algorithms
    key-cache-size: 100m                              # DNSKEY cache size (Ed25519 keys are small)
    key-cache-slabs: 4                                # Parallel key cache threads
    neg-cache-size: 10m                               # Negative response cache (NXDOMAIN, etc.)

Cache efficiency: Ed25519 keys are small, allowing more keys to fit in cache for better performance.

Enhanced Security Hardening

Apply additional security hardening to prevent various DNS attacks and ensure data integrity.

    # Enhanced security settings
    harden-glue: yes                                  # Require glue records to be in-bailiwick
    harden-dnssec-stripped: yes                       # Reject responses missing DNSSEC data
    harden-below-nxdomain: yes                        # Harden against subdomain of NXDOMAIN

Attack prevention: These settings protect against cache poisoning and DNS response manipulation attacks.

PowerDNS Algorithm Configuration

Default Algorithm Settings

Configure PowerDNS to use modern Ed25519 algorithms for all new DNSSEC zones and keys.

# PowerDNS DNSSEC Configuration with Ed25519 (pdns.conf)
# Default algorithms for new zones (modern Ed25519)
default-ksk-algorithm=ed25519                         # Algorithm 15: Ed25519 for Key Signing Keys
default-zsk-algorithm=ed25519                         # Algorithm 15: Ed25519 for Zone Signing Keys
default-ksk-size=256                                  # Ed25519 key size (fixed at 256 bits)
default-zsk-size=256                                  # Ed25519 key size (fixed at 256 bits)

Algorithm consistency: Using Ed25519 for both KSK and ZSK provides uniform security and performance across all keys.

Core DNSSEC Functionality

Enable PowerDNS DNSSEC features including record expansion and automated signing capabilities.

# Core DNSSEC functionality
dnssec=yes                                            # Enable DNSSEC signing and validation
expand-alias=yes                                      # Expand ALIAS records during signing

ALIAS expansion: Ensures ALIAS records are properly resolved and signed during the DNSSEC signing process.

Automated Key Publishing

Enable automated DS record management through CDS and CDNSKEY record publication.

# Modern DNSSEC features and publication
direct-dnskey=yes                                     # Serve DNSKEY records directly (performance)
publish-cdnskey=yes                                   # Publish CDS/CDNSKEY for automated DS updates
publish-cds=yes                                       # Enable RFC 7344 automated key rollover
default-publish-cdnskey=yes                           # Auto-publish CDS records for new zones
default-publish-cds=yes                               # Auto-publish CDNSKEY records

Automation benefit: CDS/CDNSKEY records allow registrars to automatically update DS records, reducing manual key rollover work.

Performance and Security Settings

Configure cache settings and security policies for optimal DNSSEC operation.

# Key management and security
lua-dnssec-script=/etc/powerdns/dnssec.lua          # Custom key management logic
default-ttl=3600                                      # Default TTL for signed records
dnssec-key-cache-ttl=3600                            # DNSSEC key cache timeout
max-signature-cache-entries=40000                     # Signature cache size (performance)

# Algorithm transition support
algorithm-policy=                                     # Custom algorithm policy (empty = all supported)
8bit-dns-hackaround=no                               # Don't work around broken 8-bit DNS (security)

Security hardening: Disabled 8-bit DNS workaround prevents attacks that exploit legacy DNS implementations.

Zone Initialization and Key Generation

Initialize DNSSEC for a zone and replace default keys with modern Ed25519 algorithms.

# PowerDNS DNSSEC Key Management Commands
# Initialize DNSSEC for zone (creates initial keys)
pdnsutil secure-zone example.com                     # Enable DNSSEC, generate initial RSA keys

# Replace with modern Ed25519 keys (algorithm 15)
pdnsutil add-zone-key example.com zsk active ed25519 # Zone Signing Key (signs zone data)
pdnsutil add-zone-key example.com ksk active ed25519 # Key Signing Key (signs DNSKEY records)

Key upgrade strategy: Generate new Ed25519 keys while keeping old keys active during the transition period.

Key Management and Cleanup

Remove old weak algorithm keys and manage key inventory for security maintenance.

# Remove old weak algorithm keys (if any)
pdnsutil remove-zone-key example.com 1               # Remove key by ID (check with list-keys first)
pdnsutil list-keys example.com                       # List all keys and their IDs

Safety practice: Always list keys first to identify the correct key IDs before deletion to avoid removing active keys.

DS Record Generation and Export

Generate DS records for parent zone delegation and export DNSKEY records for external validation.

# Generate DS records for parent zone delegation
pdnsutil show-zone example.com                       # Show DS records to submit to parent
pdnsutil export-zone-dnskey example.com              # Export DNSKEY records

Parent delegation: DS records must be submitted to your parent zone (registrar) to complete the chain of trust.

Key Rollover and Automation

Manage key lifecycles and enable automated DS record updates for seamless key rollovers.

# Key rollover operations
pdnsutil activate-zone-key example.com 2             # Activate key by ID
pdnsutil deactivate-zone-key example.com 1           # Deactivate old key
pdnsutil set-publish-cdnskey example.com             # Enable automated DS updates

Rollover timing: Coordinate key activation and deactivation with parent zone DS record updates.

Configuration Verification

Validate DNSSEC configuration and database compatibility before deploying changes.

# Verify DNSSEC configuration
pdnsutil check-zone example.com                      # Validate zone and DNSSEC setup
pdnsutil test-schema                                  # Test database schema compatibility

Pre-deployment testing: Always verify configuration before production deployment to prevent DNSSEC validation failures.

Cloudflare DNSSEC Management

Enable DNSSEC with modern algorithms in Cloudflare:

• Navigate to DNS → Settings → DNSSEC
• Click "Enable DNSSEC"
• Choose algorithm: ECDSA Curve P-256 with SHA-256
• Copy DS record to your domain registrar

Cloudflare API Algorithm Configuration

Enable DNSSEC with modern algorithms using the Cloudflare API for programmatic zone management.

# Enable DNSSEC via API
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dnssec" \
     -H "X-Auth-Email: email@example.com" \
     -H "X-Auth-Key: API_KEY" \
     -H "Content-Type: application/json" \
     --data '{"status":"active","algorithm":"13"}'

# Algorithm 13 = ECDSA Curve P-256 with SHA-256
# Algorithm 15 = Ed25519 (when available)

Algorithm selection: Cloudflare supports ECDSA P-256 (algorithm 13) by default, with Ed25519 support being rolled out gradually.

Algorithm Rollover Process

Proper algorithm rollover requires careful timing to maintain validation throughout the process.

Key Generation and Zone Signing

Generate new algorithm keys while maintaining the old ones to ensure continuous validation.

# Step 1: Generate new algorithm keys (keep old ones)
dnssec-keygen -a ED25519 -n ZONE example.com

# Step 2: Add new keys to zone and sign
dnssec-signzone -o example.com -t zone.file

Dual-algorithm period: Running both old and new algorithms simultaneously ensures no validation failures during transition.

Parent Zone Updates and Cleanup

Coordinate with parent zone DS record updates and remove old keys after proper propagation timing.

# Step 3: Update DS records at parent (wait for propagation)
# Step 4: Remove old algorithm keys after TTL expires
# Step 5: Verify with dig +dnssec example.com

Timing critical: Wait at least the maximum TTL value before removing old keys to prevent validation failures.

Final Validation Check

Verify that the new algorithm keys are properly published and validation is working correctly.

# Validation check
dig +dnssec +multiline example.com DNSKEY

Validation confirmation: The multiline output clearly shows algorithm numbers and key parameters for verification.

Implementation Best Practices

Algorithm rollover success depends on proper timing and validation procedures. Allow sufficient time for DNS propagation between each step, typically 2-3 days for DS record changes to propagate throughout the DNS hierarchy. Monitor your domain's DNSSEC validation status using tools like DNSViz throughout the process to catch any issues before they affect users.

Consider the operational complexity of different algorithm choices. While Ed448 provides maximum security, Ed25519 offers an excellent balance of security and performance that's suitable for most organizations. ECDSA P-256 remains a solid choice for environments requiring broad compatibility, while RSA algorithms should only be used for legacy compatibility requirements with specific upgrade timelines in place.

Last updated: July 25, 2025