IETF DNSSEC Working Group

IETF DNSSEC Working Group
Name	IETF DNSSEC Working Group
Abbreviation	DNSSEC WG
Formation	1999
Location	Internet
Parent organization	Internet Engineering Task Force

IETF DNSSEC Working Group

The IETF DNSSEC Working Group is a standards-focused effort within the Internet Engineering Task Force that develops extensions to the Domain Name System to provide origin authentication, integrity, and authenticated denial of existence for DNS data. It brings together participants from ICANN, IAB, RIPE NCC, ARIN, APNIC, LACNIC, industry vendors such as Cisco Systems, Juniper Networks, Google LLC, VeriSign, academic institutions including Stanford University, MIT, University of California, Berkeley, and policy bodies such as the Internet Society and national CERTs. The group’s outputs are published as Request for Comments documents that influence implementations by operating systems, resolver providers, and registrar ecosystems.

Overview

The Working Group focuses on extending the Domain Name System with cryptographic protections standardized in a series of Request for Comments documents shepherded through the Internet Engineering Task Force process and coordinated with entities like ICANN and regional registries. Participants include protocol designers from IETF Security Area, operators from Cloudflare, Amazon Web Services, Fastly, researchers from Carnegie Mellon University, ETH Zurich, and implementers from BIND and Knot DNS. The WG addresses interactions with protocols such as DNS-over-HTTPS, DNS-over-TLS, TLS, DANE, and infrastructure operated by root server operators including VeriSign, ICANN and the Internet Assigned Numbers Authority.

History and Milestones

Early work began in the late 1990s with the initial DNSSEC specifications produced by contributors affiliated with Paul Vixie and ISC. Key milestones include the publication of foundational RFCs during the IETF 46 meetings and subsequent clarifications at IETF 49 and IETF 56. Operational milestones include the ICANN-led deployment of DNSSEC at the Root Zone Signing event and root zone signing coordinated with US Department of Commerce transitions. Later milestones included algorithm agility updates driven by cryptographic events such as discussions following advances at NIST and algorithm deprecation advocated by researchers at ENISA and IETF Crypto Forum Research Group. The Working Group has evolved through interactions at IETF plenary sessions, working sessions at IETF hackathons, and coordination with operational bodies including DNS-OARC and RIPE NCC.

Charter and Scope

The WG’s charter defines scope in terms of protocol artefacts such as resource records, zone-signing, key management, and protocol extensions to support authenticated denial of existence and algorithm agility. Chartered deliverables intersect with algorithm considerations from NIST guidance, operational practice from IANA policies, and registry policies established by ICANN and regional registries like ARIN and RIPE NCC. The WG’s remit includes producing Request for Comments documents that specify record types, operational procedures, and transition mechanisms in coordination with the IETF Security Area and the IETF Operations and Management Area.

Technical Work and Deliverables

Technical outputs include RFCs that specify resource record types (RRSIG, DNSKEY, NSEC, NSEC3), algorithm identifiers, and protocol clarifications implemented by resolvers such as Unbound, Stubby, and getdns and authoritative servers including BIND and PowerDNS. Deliverables cover topics including key rollover procedures, zone-signing practices, authenticated denial of existence mechanisms, and algorithm agility for signatures and hashes reflecting standards discussed at IETF working group meetings. The WG coordinated updates addressing vulnerabilities reported by researchers at CERT Coordination Center and academic groups from University of Oxford and Tel Aviv University, resulting in clarifications on canonicalization, label handling, and handling of malformed data to improve interoperability across implementations from Microsoft and Apple Inc..

Implementation and Deployment

Adoption of WG outputs has been driven by large-scale deployments by DNS operators such as VeriSign, public resolvers like Google Public DNS, Cloudflare DNS, and recursive resolver operators in the RIPE NCC and APNIC communities. Registrar and registry policies influenced by the WG affect signed delegations at generic TLDs administered by ICANN and country-code TLDs managed by national registries such as Nominet and SIDN. Client and OS vendors including Mozilla', Microsoft, and Apple Inc. integrated validation support informed by WG specifications, while measurement studies by researchers at CAIDA and operational telemetry from DNS-OARC assessed deployment progress and failure modes.

Interactions with Other IETF Groups and Standards Bodies

The WG regularly coordinates with other IETF groups including the DANE Working Group, DNSOP Working Group, TLS Working Group, and the IETF Security Area to align on dependencies such as DANE, DNS-over-HTTPS, and transport-layer interactions. It engages with standards bodies and policy organizations including ICANN, IANA, NIST, ENISA, regional registries (ARIN, RIPE NCC, APNIC, LACNIC), and operational communities like DNS-OARC and national CERTs to ensure technical work meets deployment, policy, and security requirements. Cross-community liaison occurs at IETF meetings, IETF consensus calls, and joint workshops with research groups including the IETF Crypto Forum Research Group and academic centers at ETH Zurich and Carnegie Mellon University.

Category:Internet protocols