RFC 9364: DNS Security Extensions (DNSSEC)

This document describes the DNS Security Extensions (commonly called "DNSSEC") that are specified in RFCs 4033, 4034, and 4035, as well as a handful of…

Read RFC 9364 on the RFC Editor

Outgoing relationships (19 related RFCs)

Normative reference — RFC 4033: DNS Security Introduction and Requirements
Normative reference — RFC 4034: Resource Records for the DNS Security Extensions
Normative reference — RFC 5155: DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
Normative reference — RFC 3110: RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)
Normative reference — RFC 4509: Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)
Normative reference — RFC 5702: Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC
Normative reference — RFC 6840: Clarifications and Implementation Notes for DNS Security (DNSSEC)
Informative reference — RFC 2535: Domain Name System Security Extensions
Informative reference — RFC 2536: DSA KEYs and SIGs in the Domain Name System (DNS)
Informative reference — RFC 7344: Automating DNSSEC Delegation Trust Maintenance
Informative reference — RFC 6605: Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC
Informative reference — RFC 7129: Authenticated Denial of Existence in the DNS
Informative reference — RFC 6014: Cryptographic Algorithm Identifier Allocation for DNSSEC
Informative reference — RFC 7583: DNSSEC Key Rollover Timing Considerations
Informative reference — RFC 8624: Algorithm Implementation Requirements and Usage Guidance for DNSSEC
Informative reference — RFC 8901: Multi-Signer DNSSEC Models
Informative reference — RFC 9157: Revised IANA Considerations for DNSSEC
Informative reference — RFC 9276: Guidance for NSEC3 Parameter Settings
Informative reference — RFC 9077: NSEC and NSEC3: TTLs and Aggressive Use

Incoming relationships (13 related RFCs)

Normatively referenced by — RFC 9848: Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings
Normatively referenced by — RFC 9665: Service Registration Protocol for DNS-Based Service Discovery
Normatively referenced by — RFC 9859: Generalized DNS Notifications
Normatively referenced by — RFC 9718: DNSSEC Trust Anchor Publication for the Root Zone
Normatively referenced by — RFC 9824: Compact Denial of Existence in DNSSEC
Normatively referenced by — RFC 9905: Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms
Normatively referenced by — RFC 9906: Deprecate Usage of ECC-GOST within DNSSEC
Normatively referenced by — RFC 10026: Operational Recommendations for DNSSEC Delegation Signer (DS) Automation
Informatively referenced by — RFC 9803: Extensible Provisioning Protocol (EPP) Mapping for DNS Time-to-Live (TTL) Values
Informatively referenced by — RFC 9904: DNSSEC Cryptographic Algorithm Recommendation Update Process
Informatively referenced by — RFC 9575: DRIP Entity Tag (DET) Authentication Formats and Protocols for Broadcast Remote Identification (RID)
Informatively referenced by — RFC 9704: Establishing Local DNS Authority in Validated Split-Horizon Environments
Informatively referenced by — RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)