DNSSEC05 (dnssec05)

Status: Final

Purpose

  • Validate DNSKEY algorithm classes used by child-zone nameservers and report deprecated, reserved, private, unassigned, non-zone-signing, unrecommended, and acceptable algorithm usage.

Preconditions And Inputs

  • Preconditions:
    • A zone.Zone object is available.
  • Required inputs:
    • Nameserver name/IP items from methodsv2.GetDelNSNamesAndIPs and methodsv2.GetZoneNSNamesAndIPs.
    • DNSKEY query responses for child apex from the collected nameservers.
  • Profile/config knobs that affect behavior:
    • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
    • resolver.defaults.parallel: parallel DNSKEY-query execution fanout.

Algorithm And Decision Flow

  1. Emit TEST_CASE_START.
  2. Build nameserver set from delegation+zone NS items, grouped by IP.
  3. For each unique nameserver IP (parallelized):
    • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DNSKEY and skip.
    • Query child apex DNSKEY with DNSSEC enabled.
    • If response is absent, non-NOERROR, or non-AA, classify nameserver as ignored.
    • If no apex DNSKEY records are present, classify nameserver as Responds Without DNSKEY.
    • Else classify nameserver as Responds With DNSKEY, and for each DNSKEY:
      • Compute keytag.
      • Classify Algorithm value with dnssec05TagForAlgorithm.
      • Store (tag, algo, keytag, ns) tuple.
  4. Emit all DS05_ALGO_* tags grouped by (algo, keytag) with merged servers, including algo_descr and algo_mnemo.
  5. If both Responds Without DNSKEY and Responds With DNSKEY are empty, emit DS05_NO_RESPONSE for ignored nameservers.
  6. If Responds Without DNSKEY is non-empty:
    • Emit DS05_ZONE_NO_DNSSEC if Responds With DNSKEY is empty.
    • Otherwise emit DS05_SERVER_NO_DNSSEC.
  7. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

TagEmitted when
DS05_ALGO_DEPRECATEDAt least one DNSKEY algorithm maps to deprecated class.
DS05_ALGO_NOT_RECOMMENDEDAt least one DNSKEY algorithm maps to not-recommended class.
DS05_ALGO_NOT_ZONE_SIGNAt least one DNSKEY algorithm maps to not-for-zone-signing class.
DS05_ALGO_OKAt least one DNSKEY algorithm maps to acceptable class.
DS05_ALGO_PRIVATEAt least one DNSKEY algorithm maps to private-use class.
DS05_ALGO_RESERVEDAt least one DNSKEY algorithm maps to reserved class.
DS05_ALGO_UNASSIGNEDAt least one DNSKEY algorithm maps to unassigned class.
DS05_NO_RESPONSENo nameserver produced usable DNSKEY/no-DNSKEY outcome and at least one nameserver was ignored due to invalid/no response shape.
DS05_SERVER_NO_DNSSECAt least one nameserver returned a usable DNSKEY and at least one nameserver returned no usable DNSKEY.
DS05_ZONE_NO_DNSSECNo nameserver returned usable DNSKEY and at least one returned no usable DNSKEY.
IPV4_DISABLEDIPv4 transport is disabled for a queried nameserver (DNSKEY).
IPV6_DISABLEDIPv6 transport is disabled for a queried nameserver (DNSKEY).
TEST_CASE_ENDTestcase completion marker is emitted.
TEST_CASE_STARTTestcase start marker is emitted.

Tag Arguments

TagArgument keyTypeMeaning
DS05_ALGO_DEPRECATEDserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_DEPRECATEDkeytagintDNSKEY keytag.
DS05_ALGO_DEPRECATEDalgo_numintDNSKEY algorithm number.
DS05_ALGO_DEPRECATEDalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_DEPRECATEDalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_NOT_RECOMMENDEDserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_NOT_RECOMMENDEDkeytagintDNSKEY keytag.
DS05_ALGO_NOT_RECOMMENDEDalgo_numintDNSKEY algorithm number.
DS05_ALGO_NOT_RECOMMENDEDalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_NOT_RECOMMENDEDalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_NOT_ZONE_SIGNserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_NOT_ZONE_SIGNkeytagintDNSKEY keytag.
DS05_ALGO_NOT_ZONE_SIGNalgo_numintDNSKEY algorithm number.
DS05_ALGO_NOT_ZONE_SIGNalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_NOT_ZONE_SIGNalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_OKserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_OKkeytagintDNSKEY keytag.
DS05_ALGO_OKalgo_numintDNSKEY algorithm number.
DS05_ALGO_OKalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_OKalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_PRIVATEserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_PRIVATEkeytagintDNSKEY keytag.
DS05_ALGO_PRIVATEalgo_numintDNSKEY algorithm number.
DS05_ALGO_PRIVATEalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_PRIVATEalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_RESERVEDserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_RESERVEDkeytagintDNSKEY keytag.
DS05_ALGO_RESERVEDalgo_numintDNSKEY algorithm number.
DS05_ALGO_RESERVEDalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_RESERVEDalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_ALGO_UNASSIGNEDserversarray<object>Structured nameserver identities ({ns,address} object) for this (algo,keytag) class entry.
DS05_ALGO_UNASSIGNEDkeytagintDNSKEY keytag.
DS05_ALGO_UNASSIGNEDalgo_numintDNSKEY algorithm number.
DS05_ALGO_UNASSIGNEDalgo_descrstringDNSKEY algorithm description.
DS05_ALGO_UNASSIGNEDalgo_mnemostringDNSKEY algorithm mnemonic.
DS05_NO_RESPONSEserversarray<object>Structured nameserver identities ({ns,address} object) ignored due to invalid/no response shape.
DS05_SERVER_NO_DNSSECserversarray<object>Structured nameserver identities ({ns,address} object) returning no usable DNSKEY while other nameservers did.
DS05_ZONE_NO_DNSSECserversarray<object>Structured nameserver identities ({ns,address} object) returning no usable DNSKEY.
IPV4_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv4.
IPV4_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV4_DISABLEDrrtypestringrrtype skipped (DNSKEY).
IPV6_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv6.
IPV6_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV6_DISABLEDrrtypestringrrtype skipped (DNSKEY).
TEST_CASE_ENDtestcasestringTestcase display name (DNSSEC05).
TEST_CASE_STARTtestcasestringTestcase display name (DNSSEC05).

Severity Levels Per Tag

TagLevelNotes
DS05_ALGO_DEPRECATEDERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_NOT_RECOMMENDEDWARNINGDefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_NOT_ZONE_SIGNERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_OKINFODefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_PRIVATEERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_RESERVEDERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_ALGO_UNASSIGNEDERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_NO_RESPONSEWARNINGDefault from share/profile.json (test_levels.DNSSEC).
DS05_SERVER_NO_DNSSECERRORDefault from share/profile.json (test_levels.DNSSEC).
DS05_ZONE_NO_DNSSECNOTICEDefault from share/profile.json (test_levels.DNSSEC).
IPV4_DISABLEDDEBUGDefault from share/profile.json (test_levels.DNSSEC).
IPV6_DISABLEDDEBUGDefault from share/profile.json (test_levels.DNSSEC).
TEST_CASE_ENDDEBUGDefault from share/profile.json (test_levels.DNSSEC).
TEST_CASE_STARTDEBUGDefault from share/profile.json (test_levels.DNSSEC).

Differences From Upstream

  • Upstream reference: dnssec05.md
  • Differences (Upstream vs Gonemaster):
    • Upstream: summary argument list omits algo_descr and algo_mnemo for some DS05 tags. Gonemaster: emits both algo_descr and algo_mnemo for all emitted DS05_ALGO_* tags.
    • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
  • Potential upstream report:
    • no

Edge Cases And Limitations

  • Nameserver evaluation is deduplicated by IP; multiple names mapped to one IP are merged into one query outcome and expanded in servers.
  • Nameservers with non-NOERROR or non-AA DNSKEY responses are treated as ignored for DS05 classification and can only contribute to DS05_NO_RESPONSE.
  • If a DNSKEY algorithm maps outside explicit switch cases, Gonemaster classifies it as DS05_ALGO_UNASSIGNED.