RFC 4035

RFC 4035
Title	RFC 4035
Type	Informational
Author	Paul Vixie; Jacob Schlyter; Paul W. Mockapetris
Pubdate	March 2005
Status	Standards Track
Related	DNS, DNSSEC, RFC 4033, RFC 4034

RFC 4035

RFC 4035 is a standards-track document that specifies protocol behaviors for DNS Security Extensions in the context of the Domain Name System. It operates alongside related standards and technical contributions from prominent organizations and individuals involved in Internet infrastructure and cryptographic engineering. The document refines resolver and server behavior, articulating interactions among deployed implementations and standards bodies.

Overview

RFC 4035 sits within a family of documents that rework and extend the Domain Name System developed initially by Paul Mockapetris and later shepherded by engineering groups. It complements protocols and specifications promulgated by the Internet Engineering Task Force, the Internet Architecture Board, and working groups such as the DNS Extensions (dnssext) and Security Area. The specification addresses interactions with cryptographic primitives defined by standards bodies and relates to operational practice among registries like the Internet Assigned Numbers Authority and regional registries such as ARIN and RIPE NCC.

Purpose and Scope

The primary aim of RFC 4035 is to define resolver and server protocol behaviors needed to support DNS Security Extensions as standardized alongside other documents authored or influenced by engineers from organizations like ISC, Verisign, and universities engaged in networking research. Its scope includes authoritative and recursive name server processing, caching behavior, and signal semantics used by implementations from vendors such as Cisco, Juniper, and Microsoft. The document also delineates interoperability expectations for open-source projects like BIND, Unbound, and djbdns that implement DNSSEC features.

Key Protocol Elements

RFC 4035 specifies how DNS messages carry cryptographic assurances provided by resource records like RRSIG and DNSKEY and how validators process these records in conjunction with chain-of-trust constructs. It prescribes message handling for delegation records and glue records in zones administered through registrars accredited by ICANN. The protocol elements interact with cryptographic algorithms standardized by bodies such as the IETF's Crypto Forum Research Group and reference implementations using libraries like OpenSSL, NSS, and crypto modules developed by NIST collaborators. The document lays out canonicalization rules, time validation using UTC and leap-second considerations discussed in forums like ITU-R, and error signaling used by resolver libraries in operating systems developed by vendors including Apple and Google.

Security Considerations

Security guidance in RFC 4035 addresses threats evaluated by researchers at institutions like MIT, Stanford, and CMU and oversight groups including the National Institute of Standards and Technology. It prescribes validation failure behavior, trust anchor management, and mitigations for replay and downgrade attacks identified in academic literature and vulnerability advisories from CERT/CC. The document interfaces with legal and policy frameworks established in multistakeholder settings such as ICANN meetings and national cybersecurity strategies, and it anticipates operational concerns raised by registries and root server operators including the operators of L-root and K-root.

Implementation and Deployment

Implementers from commercial vendors, open-source communities, and academic projects have used RFC 4035 as a basis for DNSSEC-capable resolvers and authoritative servers. Deployments have occurred across top-level domain operators, ccTLD managers like Nominet, and enterprise networks using products from Hewlett-Packard and IBM. The specification informs deployment toolchains produced by consultancy firms and research labs, and it intersects with measurement studies conducted by organizations such as APNIC and the RIPE NCC on DNSSEC adoption and operational impacts. Compatibility testing and testbeds organized by IETF working groups and network operator groups help validate conformance with the behaviors RFC 4035 prescribes.

History and Standardization Process

The document emerged from a lineage of contributions to DNS by figures like Paul Mockapetris and subsequent refinements by the IETF's dnsop and dnssec working groups. It followed earlier milestone publications that re-envisioned DNS security and was reviewed through the IETF last-call process, shepherded by area directors and working group chairs with input from operators at root server operators meetings and the Internet Society. The standardization process included interoperability events, mailing list discourse, and revisions incorporating feedback from national registries and cryptographic research labs. Editorial coordination involved authors with prior RFC authorship and contributors from vendor and academic communities.

Reception and Impact

RFC 4035 has been cited in operational guidelines and academic analyses assessing DNS security, and it influenced subsequent protocol refinements and deprecation decisions in the DNS ecosystem. Its adoption contributed to the incremental rollout of DNSSEC across gTLD and ccTLD zones and informed tooling used by network operators and security practitioners. The document's principles persist in current discussions at the IETF, in workshops hosted by the Internet Society, and in technical curricula at institutions teaching networking and cybersecurity.

Category:Internet standards