Why should users be forced to accept that lookups for some zones will fail because the signers can’t get their act together and agree on a common set of algorithms to sign the zone with? Nobody is forcing you to use multiple signers. You are choosing to sign the zone this way.
Multi signers fails badly with chained validators. They don’t even have the option of retrying another authoritative server. They just get the cached answer from upstream with an algorithm they don’t understand but DS records saying they should be getting signatures they they do support. We regularly see decades old nameservers out there that are running fine. -- Mark Andrews > On 29 Jul 2026, at 01:19, Philip Homburg <[email protected]> wrote: > > >> >> There is a difference >> accepting any path and publishing zones that will FAIL TO VALIDATE >> AS SECURE OR INSECURE! DNSSEC was designed to fail insecure on >> old validators that didnt support any of the algorithms. The rules >> that the signer needs to sign ALL records with ALL of the algorithms >> in the DS set is designed to prevent validators with a properly >> signed zone getting answers that validate as BOGUS! Signers which >> do not follow that rule WILL (100% guaranteed) produce zones that >> will produce answers that validate as BOGUS on some validators. > > Sometimes the rules on what is acceptable on the Internet change. > > What the multi-algorithm draft basically says is that if a validator > implements > either of RSASHA256 and ECDSA then it has to implement both. > > That is a change. And it does affect validators that implement only one > of them. That changes the rules of the games. That's life. > > This doesn't mean that all zone will immediately start using this feature. > I'm sure operators will carefully evaluate the impact. But maybe somebody > who is still running a decades old validator that does not support ECDSA > is out of luck. > > If we look at > https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1 > then both RSASHA256 and ECDSA are MUST implement for DNSSEC validation. > > So a validator that is potentially negatively affected by the draft is already > violating current requirements. > > I see no reason why that would stop this draft from progressing. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
