Table of contents

DNSSEC Tools

• DNSSEC Analyzer [visited 2019-11-04T22:12:03Z]
• DNSViz | A DNS visualization tool [visited 2019-11-04T22:13:12Z]

Algorithm Numbers

• Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms:
  IANA registry: Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms [visited 2019-11-16T19:19:39Z]
• Domain Name System Security (DNSSEC) Algorithm Numbers:
  IANA registry: Domain Name System Security (DNSSEC) Algorithm Numbers [visited 2019-11-04T21:50:10Z]

Domains that use specific algorithms

• Various:
  All links in the following list were checked 2019-11-17 if not remarked otherwise.
  All of the domains use Delegation Signer (DS) Resource Record (RR) Type Digest Algorithm 2 (SHA-256).
  • nsa.gov.
    • Domain Name System Security (DNSSEC) Algorithm: 7 (RSASHA1-NSEC3-SHA1)
    • DNSSEC Analyzer link
    • DNSViz link
    • Interesting side remark: root (.) uses both digest algorithms 1 (SHA-1) and 2 (SHA-256) to sign gov.
  • nl.
    • Domain Name System Security (DNSSEC) Algorithm: 8 (RSA/SHA-256)
    • DNSSEC Analyzer link
    • DNSViz link
  • dnssec-check.nl.
    • Domain Name System Security (DNSSEC) Algorithm: 13 (ECDSA Curve P-256 with SHA-256)
    • DNSSEC Analyzer link
    • DNSViz link
  • ed25519.nl.
    • Domain Name System Security (DNSSEC) Algorithm: 15 (Ed25519)
    • DNSSEC Analyzer link
    • DNSViz link
    • Website: https://ed25519.nl [visited 2019-11-04T22:02:40Z]
    • Source: Please add support for algo 15+16 · Issue #28 · dnsviz/dnsviz [visited 2019-11-04T21:44:15Z]

• The Root Canary Project (https://rootcanary.org/ [visited 2019-11-12T19:34:49Z]) provides an Algorithm Test (https://rootcanary.org/test.html [visited 2019-11-12T19:36:27Z]) to test various DNSSEC algorithms:

  Remarks:

  • As of today (2020-04-19), DNSSEC Analyzer gives an error if Algorithm # 12 (GOST R 34.10-2001) is used (except in combination with the GOST R 34.11-94 Delegation Signer (DS) Resource Record (RR) Type Digest Algorithm).
  • As of today (2020-04-19), DNSSEC Analyzer gives no error if GOST R 34.11-94 Delegation Signer (DS) Resource Record (RR) Type Digest Algorithm is used on a bogus domain.
  • As of today (2020-04-19), DNSViz does not support Algorithm # 16 (Ed448); see also Please add support for algo 15+16 · Issue #28 · dnsviz/dnsviz [visited 2019-11-04T21:44:15Z].

  In the first two cases, we gave the respective links in the following table a red background. In the third case, we gave the respective links in the following table a yellow-orange background, since DNSViz shows an explicit warning that Algorithm # 16 (Ed448) is not supported.

  All links in the following table were checked 2019-11-17. The rows “RSA/MD5” and “GOST R 34.10-2001” and the column “GOST R 34.11-94” were rechecked 2020-04-19.

  Secure:

  			Delegation Signer (DS) Resource Record (RR) Type Digest Algorithm
  			Number	1	2	3	4
  			Description	SHA-1	SHA-256	GOST R 34.11-94	SHA-384
  Domain Name System Security (DNSSEC) Algorithm
  Number	Description	Mnemonic
  1	RSA/MD5	RSAMD5	Domain	secure.d1a1n1.rootcanary.net.	secure.d2a1n1.rootcanary.net.	secure.d3a1n1.rootcanary.net.	secure.d4a1n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  3	DSA/SHA1	DSA	Domain	secure.d1a3n1.rootcanary.net.	secure.d2a3n1.rootcanary.net.	secure.d3a3n1.rootcanary.net.	secure.d4a3n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  5	RSA/SHA-1	RSASHA1	Domain	secure.d1a5n1.rootcanary.net.	secure.d2a5n1.rootcanary.net.	secure.d3a5n1.rootcanary.net.	secure.d4a5n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  6	DSA-NSEC3-SHA1	DSA-NSEC3-SHA1	Domain	secure.d1a6n3.rootcanary.net.	secure.d2a6n3.rootcanary.net.	secure.d3a6n3.rootcanary.net.	secure.d4a6n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  7	RSASHA1-NSEC3-SHA1	RSASHA1-NSEC3-SHA1	Domain	secure.d1a7n3.rootcanary.net.	secure.d2a7n3.rootcanary.net.	secure.d3a7n3.rootcanary.net.	secure.d4a7n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  8	RSA/SHA-256	RSASHA256	Domain	secure.d1a8n3.rootcanary.net.	secure.d2a8n3.rootcanary.net.	secure.d3a8n3.rootcanary.net.	secure.d4a8n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  10	RSA/SHA-512	RSASHA512	Domain	secure.d1a10n3.rootcanary.net.	secure.d2a10n3.rootcanary.net.	secure.d3a10n3.rootcanary.net.	secure.d4a10n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  12	GOST R 34.10-2001	ECC-GOST	Domain	secure.d1a12n3.rootcanary.net.	secure.d2a12n3.rootcanary.net.	secure.d3a12n3.rootcanary.net.	secure.d4a12n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  13	ECDSA Curve P-256 with SHA-256	ECDSAP256SHA256	Domain	secure.d1a13n3.rootcanary.net.	secure.d2a13n3.rootcanary.net.	secure.d3a13n3.rootcanary.net.	secure.d4a13n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  14	ECDSA Curve P-384 with SHA-384	ECDSAP384SHA384	Domain	secure.d1a14n3.rootcanary.net.	secure.d2a14n3.rootcanary.net.	secure.d3a14n3.rootcanary.net.	secure.d4a14n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  15	Ed25519	ED25519	Domain	secure.d1a15n3.rootcanary.net.	secure.d2a15n3.rootcanary.net.	secure.d3a15n3.rootcanary.net.	secure.d4a15n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  16	Ed448	ED448	Domain	secure.d1a16n3.rootcanary.net.	secure.d2a16n3.rootcanary.net.	secure.d3a16n3.rootcanary.net.	secure.d4a16n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link

  Bogus:

  			Delegation Signer (DS) Resource Record (RR) Type Digest Algorithm
  			Number	1	2	3	4
  			Description	SHA-1	SHA-256	GOST R 34.11-94	SHA-384
  Domain Name System Security (DNSSEC) Algorithm
  Number	Description	Mnemonic
  1	RSA/MD5	RSAMD5	Domain	bogus.d1a1n1.rootcanary.net.	bogus.d2a1n1.rootcanary.net.	bogus.d3a1n1.rootcanary.net.	bogus.d4a1n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  3	DSA/SHA1	DSA	Domain	bogus.d1a3n1.rootcanary.net.	bogus.d2a3n1.rootcanary.net.	bogus.d3a3n1.rootcanary.net.	bogus.d4a3n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  5	RSA/SHA-1	RSASHA1	Domain	bogus.d1a5n1.rootcanary.net.	bogus.d2a5n1.rootcanary.net.	bogus.d3a5n1.rootcanary.net.	bogus.d4a5n1.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  6	DSA-NSEC3-SHA1	DSA-NSEC3-SHA1	Domain	bogus.d1a6n3.rootcanary.net.	bogus.d2a6n3.rootcanary.net.	bogus.d3a6n3.rootcanary.net.	bogus.d4a6n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  7	RSASHA1-NSEC3-SHA1	RSASHA1-NSEC3-SHA1	Domain	bogus.d1a7n3.rootcanary.net.	bogus.d2a7n3.rootcanary.net.	bogus.d3a7n3.rootcanary.net.	bogus.d4a7n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  8	RSA/SHA-256	RSASHA256	Domain	bogus.d1a8n3.rootcanary.net.	bogus.d2a8n3.rootcanary.net.	bogus.d3a8n3.rootcanary.net.	bogus.d4a8n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  10	RSA/SHA-512	RSASHA512	Domain	bogus.d1a10n3.rootcanary.net.	bogus.d2a10n3.rootcanary.net.	bogus.d3a10n3.rootcanary.net.	bogus.d4a10n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  12	GOST R 34.10-2001	ECC-GOST	Domain	bogus.d1a12n3.rootcanary.net.	bogus.d2a12n3.rootcanary.net.	bogus.d3a12n3.rootcanary.net.	bogus.d4a12n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  13	ECDSA Curve P-256 with SHA-256	ECDSAP256SHA256	Domain	bogus.d1a13n3.rootcanary.net.	bogus.d2a13n3.rootcanary.net.	bogus.d3a13n3.rootcanary.net.	bogus.d4a13n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  14	ECDSA Curve P-384 with SHA-384	ECDSAP384SHA384	Domain	bogus.d1a14n3.rootcanary.net.	bogus.d2a14n3.rootcanary.net.	bogus.d3a14n3.rootcanary.net.	bogus.d4a14n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  15	Ed25519	ED25519	Domain	bogus.d1a15n3.rootcanary.net.	bogus.d2a15n3.rootcanary.net.	bogus.d3a15n3.rootcanary.net.	bogus.d4a15n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link
  16	Ed448	ED448	Domain	bogus.d1a16n3.rootcanary.net.	bogus.d2a16n3.rootcanary.net.	bogus.d3a16n3.rootcanary.net.	bogus.d4a16n3.rootcanary.net.
  			DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link	DNSSEC Analyzer link
  			DNSViz link	DNSViz link	DNSViz link	DNSViz link	DNSViz link

Articles

• A lock with many keys: Spoofing DNSSEC-signed domains in 8.8.8.8 [published 2022-03-11; visited 2022-03-12T17:51:35Z]