RFC 3658: Delegation Signer (DS) Resource Record (RR)
This RFC has been replaced. Do not implement against it for new work — it was formally obsoleted by RFC 4033, RFC 4034, RFC 4035.
Current document in this lineage: RFC 4033 — DNS Security Introduction and Requirements; RFC 4034 — Resource Records for the DNS Security Extensions; RFC 4035 — Protocol Modifications for the DNS Security Extensions
In plain English — editorial summary, not part of the RFC
The delegation signer (DS) resource record (RR) is inserted at a zone cut (i.e., a delegation point) to indicate that the delegated zone is digitally signed and that the delegated zone recognizes the indicated key as a valid zone key for the delegated zone. The DS RR is a modification to the DNS Security Extensions definition, motivated by operational considerations. The intent is to use this resource record as an explicit statement about the delegation, rather than relying on inference. This document defines the DS RR, gives examples of how it is used and describes the implications on resolvers. This change is not backwards compatible with RFC 2535. This document updates RFC 1035, RFC 2535, RFC 3008 and RFC 3090.
Document record
- Document ID
- RFC3658
- Published
- December 2003
- Authors
- O. Gudmundsson
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- int
- Pages
- 19
- Also known as
- —
- Updated by:
- RFC 3755
Topics
Standards lineage
This document is one revision in a chain of 13 RFCs, each formally replacing the one before it.
- RFC 2065 (1997)
- RFC 2535 (1999)
- RFC 3008 (2000)
- RFC 3090 (2001)
- RFC 3445 (2002)
- RFC 3655 (2003)
- RFC 3658 (2003)
- RFC 3755 (2004)
- RFC 3757 (2004)
- RFC 3845 (2004)
- RFC 4033 (2005)
- RFC 4034 (2005)
- RFC 4035 (2005) ✓
Read the full history of Protocol Modifications for the DNS Security Extensions →
Referenced by
4 later RFCs formally update or obsolete part of this document.
- RFC 3755Legacy Resolver Compatibility for Delegation Signer (DS)Obsoleted
May 2004
- RFC 4033DNS Security Introduction and RequirementsUpdated
March 2005
- RFC 4034Resource Records for the DNS Security ExtensionsUpdated
March 2005
- RFC 4035Protocol Modifications for the DNS Security ExtensionsUpdated
March 2005
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 3110RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)Updated
May 2001
- RFC 2931DNS Request and Transaction Signatures ( SIG(0)s )Current
September 2000
- RFC 7830The EDNS(0) Padding OptionCurrent
May 2016
- RFC 3646DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)Current
December 2003
- RFC 3597Handling of Unknown DNS Resource Record (RR) TypesUpdated
September 2003
- RFC 3596DNS Extensions to Support IP Version 6Current
October 2003
- RFC 3123A DNS RR Type for Lists of Address Prefixes (APL RR)Current
June 2001
- RFC 3007Secure Domain Name System (DNS) Dynamic UpdateCurrent
November 2000
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?