Hi Stefan, I'm sorry, it's not possible to configure more DNSSEC policies (more algorithms) per one zone at the same time. Maybe, with the manual key management and more configuration files when generating keys via keymgr, it could work somehow. But I'm not sure and probably it's not what you are looking for :-) Daniel On 22. 07. 21 16:55, Schindler, Stefan wrote:

Hello. On 23/07/2021 16.13, Schindler, Stefan wrote: As the current DNSSEC standards go, I think it's normally not worth using two algorithms at once on a single zone (except temporarily when changing from one to another). Validators will succeed when validation with *any* of the algorithms succeeds. Therefore adding a stronger algo won't make the result stronger (attackers can choose which one to compromise) - at least until the weaker algo gets (commonly) considered as insecure. Weirdly enough, DNSSEC validators do not do that even with short RSAs - one problem is that standardized (non-)support mechanism is independent of key length. That's OK for the new fixed-length algos but not so much for RSA. --Vladimir | knot-resolver.cz

Hi Daniel, Would it be possible to activate more than one algorithm in a policy? If not, how hard would it be to include that functionality? Because for some reason a lot of ISP resolvers support RSA only while I would like to future-proof my zone with ED25519 at the same time. Cheers, Stefan Am Do., 22. Juli 2021 um 19:56 Uhr schrieb Daniel Salzman &lt;daniel.salzman(a)nic.cz <mailto:daniel.salzman@nic.cz>>: Hi Stefan, I'm sorry, it's not possible to configure more DNSSEC policies (more algorithms) per one zone at the same time. Maybe, with the manual key management and more configuration files when generating keys via keymgr, it could work somehow. But I'm not sure and probably it's not what you are looking for :-) Daniel On 22. 07. 21 16:55, Schindler, Stefan wrote: