Hello
UltraDNS is working on implementations of the multi-signer DNSSEC (RFC 8901)
specification.
It has been our desire to be able to use CDNSKEY records as an indicator to other signers
that a ZSK roll is in process and the other signer should adjust their DNSKEY rrSet to
reflect the new ZSK created by the UltraDNS signing processes.
Our interpretations of RFCs 7344 and 8078 do not prohibit the use of CDNSKEY for this
purpose and we had developed the service to publish CDNSKEY records with a DNSKEY flags
value of 256 to indicate a change in the ZSK for the zone.
Unfortunately, this approach appears to be causing issues for TLDs using FRED as the
cdnskey scanner process does not consider the flags attribute of the rdata and treats
every CDNSKEY record as a KSK key event.
We would like know if FRED could be updated to consider the flags of CDNSKEY records and
only act on those records where the SEP indicator is set - i.e. flags = 257?
Acknowledging that the RFCs are silent on the use of flags=256 in a CDNSKEY record, it
seems to us to be a reasonable use of the CDNSKEY record for signaling and informing other
signers implementing RFC 8901.
Thoughts?
Steve deJong
UltraDNS