RFC - 4470
Minimally Covering NSEC Records and DNSSEC On-line Signing
| Original: | ftp://ftp.isi.edu/in-notes/rfc4470.txt |
|---|---|
| Authors: | S. Weiler [SPARTA, Inc.], J. Ihren [Autonomica AB] |
| Date: | April 2006 |
| Category: | Proposed Standard |
| Updates: | |
|---|---|
| RFC-4035prop | Protocol Modifications for the DNS Security Extensions (Updated by RFC-4470prop) |
| RFC-4034prop | Resource Records for the DNS Security Extensions (Updated by RFC-4470prop) |
| Referred by: | 1 RFC |
| Refers to: | 4 RFC |
Status
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This document describes how to construct DNSSEC NSEC resource records that cover a smaller range of names than called for by RFC 4034. By generating and signing these records on demand, authoritative name servers can effectively stop the disclosure of zone contents otherwise made possible by walking the chain of NSEC records in a signed zone.
-
prepared by Miloslav Nic
- the founder of Zvon.org and Law-Ref.org
- the head of B.Sc. program Informatics and chemistry [in Czech]
- the founder of Lidem.org - Volby 2006 - parliamentary elections in the Czech Republic [in Czech]
- the chief consultant of the publishing house ICT Press
- and Pavel Srb, a student of B.Sc. program Informatics and chemistry