]> ISC

pspacek@isc.org

Akamai Technologies

rweber@akamai.com

Salesforce

tale@dd.org

Internet deleg Internet-Draft DNS delegation This document specifies a new extensible method for the delegation of authority for a domain in the Domain Name System (DNS) using DELEG and DELEGPARAM records. A delegation in the DNS enables efficient and distributed management of the DNS namespace. The traditional DNS delegation is based on NS records which contain only hostnames of servers and no other parameters. In classic DNS, both parent and child zones contain copies of NS delegation records, which can potentially be out of sync and confusing. The new delegation records are extensible, can be secured with DNSSEC, and eliminate the problem of having two sources of truth for delegation information. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the deleg Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction In the Domain Name System, authority for each subdomain within the domain name hierarchy can be delegated to different servers, which makes them authoritative for their portion of the namespace. Traditionally, a delegation is represented by an NS RRset, which contains the hostnames of name servers, though no other parameters. The resolver resolves these names into usable addresses and uses default protocol parameters, for transport protocol and any other protocol features. Moreover, the NS RRset exists in two places--one at the delegation point, and the other at the apex of the delegated zone, which might not match the NS records at the delegation. DNSSEC authenticates the authoritative NS RRset in the delegated zone but does not authenticate the delegation NS RRset. The lack of properties of delegation NS RRsets limits resolvers to unauthenticated transport on default ports, and this initial contact is not protected with DNSSEC. These limitations are a barrier for the efficient introduction of new DNS technology. The DELEG and DELEGPARAM resource record (RR) types remedy this problem by providing extensible parameters to indicate authoritative name server capabilities and additional information, such as other transport protocols that a resolver may use. The DELEG RRset creates a new delegation. It is a Delegation Type record as defined in . It is authoritative in the delegating zone and can be signed with DNSSEC. This makes it possible to authenticate the delegation parameters carried by DELEG, including future extensions. The DELEG RRset can be used alongside, or instead of, an NS RRset to create a delegation. The combination of DELEG and NS RRsets is compatible with resolvers that do not support DELEG, facilitating the incremental rollout of this new method. The DELEGPARAM record is an auxiliary record which contains the same data as DELEG, but does not create a delegation. Instead it is used as the target when DELEG is optionally using indirection. This indirection can, for example, be used to share the same delegation information across multiple zones and simplify operational management by reducing the number of locations for the delegation information for those zones. For example, if the customers of a DNS operator create a DELEG record pointing to a DELEGPARAM record managed by the DNS operator, then the operator will be able to make delegation information changes without further customer involvement, and affect all of those customer's delegations with a single change. Future documents can define additional delegation parameters, for example to advertise support for encrypted transports.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Terminology regarding the Domain Name System comes from , with additional terms defined here:

• legacy delegation: A delegation that is done with an NS RRset
• Delegation Type: Defined in .
• Delegation-Extension-aware: Defined in .
• DELEG-aware: DNS software that follows the protocol defined in this document. DELEG-aware software is inherently Delegation-Extension-aware.
• DELEG-unaware: DNS software that does not follow the protocol defined in this document.
• non-DELEG specifications: DNS protocols that predate this protocol, or are written after this protocol is published but are not related to this protocol.
• Delegation NS RRset: An NS RRset that delegates authority of a subdomain to a set of authoritative servers.
• Authoritative NS RRset: An NS RRset at the apex of a zone.

Protocol Overview This section is a brief overview of the DELEG protocol. It is meant for people who want to understand the protocol before they dive deeper into the specifics. The DELEG protocol is built on top of . When a DELEG-aware resolver sends DNS queries, it sets the DE bit in the EDNS0 header to 1 in queries to authoritative servers, as a signal that it is DELEG-aware. DELEG-unaware authoritative servers intrinsically ignore this signal. A DELEG-aware authoritative server uses that signal to determine the type of response it will send. If the response is a referral (i.e., a delegation), the authoritative server checks if there is a DELEG RRset for the queried zone. If so, it returns the DELEG RRset instead of any NS RRset in the response. If the response is not a referral, the authoritative server doesn't change anything about how it responds. Records in the DELEG RRset for a zone describe how to find name servers for that zone (). The RDATA for DELEG records has key=value pairs ().

• "server-ipv4" and "server-ipv6" keys contain one or more IP addresses for the delegated name servers
• "server-name" key contains one or more hostnames for the delegated name servers; the addresses must be resolved separately
• "include-delegparam" key contains one or more domain names which in turn have more information about the delegation
• "mandatory" key contains a list of other keys which must be present in the same record, and which the resolver must understand in order to use that record

The DELEG-aware resolver uses the information in the DELEG RRset to form the list of best servers to ask about the delegated zone (). If the DELEG RRset contains "include-delegparam", the resolver queries those hostnames for DELEGPARAM RRsets. DELEGPARAM records have the same format as DELEG records; thus, they can have the same key=value pairs. DELEG RR type is a Delegation Type, thus authoritative at the delegation point, signed and validated as authoritative data, similar to DS records. A zone might be delegated with only DELEG records but no NS records. Such a zone would be invisible to DELEG-unaware resolvers. In order to protect validators from downgrade attacks, this document mandates the use of DNSKEY-ADT flag described in . There are many parts of the DELEG protocol that are not included in this brief overview. For example, DELEG-aware authoritative servers have choices to make depending both on the request and the contents of the zone file. For those readers who learn better from examples than the definitive text, see .

DELEG and DELEGPARAM Resource Record Types The DELEG record has an RR type that is TBD1. It is an NS-Omitting Delegation Type, as defined in ; thus, TBD1 will be from the 0xF000-0xF07F range. The DELEGPARAM record has an RR type of TBD2. It is not a Delegation Type, and thus will not come from the range defined in . The DELEG record and the DELEGPARAM record have the same wire and presentation formats, but their semantics are different as described in a following section. The record format is based on the extensible key=value list that was originally defined as "SvcParams" for the SVCB record type . Unlike SVCB, the DELEG protocol does not have "SvcPriority" and "TargetName" fields. The keys in the DELEG protocol are also different than those used in SVCB. To avoid confusion between the two protocols, the list of key=value parameters used by the DELEG protocol are called DelegInfos and are tracked in their own IANA registry for Delegation Information. The following rules are adapted from SVCB, but with changed names:

• The whole RDATA consists of a single list called "DelegInfos".
• The DelegInfos list consists of individual DelegInfo element key=value pairs.
• Each DelegInfo element has a DelegInfoKey and an optional DelegInfoValue.
• Each DelegInfo element has a specified presentation format and associated wire format.
• Each DelegInfoKey has a presentation name and a registered key number.
• Each DelegInfoValue is in a format specific to its DelegInfoKey.

Implementations can reuse the same code to parse SvcParams and DelegInfos and only plug in a different list of key=value pairs for the SVCB/HTTPS and DELEG/DELEGPARAM record families. The initial set of DelegInfoKeys and associated DelegInfoValues, plus their presentation and wire formats, are defined in .

Presentation Format The RDATA presentation format of the DELEG and DELEGPARAM resource records consists of a single list, DelegInfos. The DelegInfos presentation format is defined exactly the same as SvcParams in Section 2.1 of . The following rules are adapted from SVCB, but with changed names:

• DelegInfos is a whitespace-separated list with each DelegInfo consisting of a DelegInfoKey=DelegInfoValue pair, or a standalone DelegInfoKey.
• Individual element definitions are the same as :
  • The DelegInfo syntax is the same as SvcParam, but it references DelegInfo elements instead of SvcParam elements.
  • The DelegInfoKey syntax is the same as SvcParamKey.
  • The syntax for unknown keys in Section 2.1 of applies.
  • The DelegInfoValue syntax is the same as SvcParamValue.
  • The rules from Appendix A of apply.
• All the requirements in Section 2.1 of apply.

DelegInfos MAY be zero-length; this is similar to what is allowed in SVCB records. Note that a zero-length DelegInfos provides no information to the resolution algorithm, and thus will be not be processed in step 1 of .

RDATA Wire Format The RDATA portion of the DELEG and DELEGPARAM resource record is variable length and entirely consists of a single "DelegInfos" element: The format of the DelegInfo element is identical to the format of the SvcParams element defined in Section 2.2, including the requirements for strictly increasing numeric order to keys and no key duplication allowed. All the requirements in Section 2.2 of apply. The DelegInfos list is a sequence of individual DelegInfo elements and MAY be empty. The wire format of an individual DelegInfo element is the same as for a SvcParam element, but it references DelegInfo elements instead of SvcParam elements. The structure of a single "DelegInfo" element is: The permissible lengths depend on the DelegInfoKey value. Some future keys may have no DelegInfoValue, which would be indicated with an explicit 0 length.

Semantics The following is a brief summary of semantic differences between the DELEG and DELEGPARAM types.

• DELEG has special processing for being included in answers.
• DELEG creates a delegation for its owner name, similar to the NS RR type.
• DELEG and NS RR types can coexist at the same owner name.
• DELEG is authoritative at the delegation point, similar to the DS RR type, and unlike the NS RR type.
• DELEG is signed when using DNSSEC, similar to the DS RR type, and unlike the NS RR type.
• DELEG cannot be present at the apex of the delegated zone, similar to the DS RR type, and unlike the NS RR type.

Conversely,

• DELEGPARAM is an ordinary RR and doesn't require any special processing.
• DELEGPARAM does not create a delegation for its owner name.
• DELEGPARAM cannot exist at a delegation point.
• DELEGPARAM DNSSEC-signing and record-placement rules are the same as for any ordinary RR type.
• DELEGPARAM is used as the target of the DELEG protocol's "include-delegparam" mechanism, as described in .

Note that neither DELEG nor DELEGPARAM trigger Additional Section processing like NS does. The significance of this difference is addressed more in the next section.

Name Server Information for Delegation The DELEG and DELEGPARAM records have four keys that describe information about name servers. The purpose of this information is to populate the SLIST (see ) with IP addresses of the name servers for a zone. The types of information defined in this document are:

• server-ipv4: an unordered collection of IPv4 addresses for name servers
• server-ipv6: an unordered collection of IPv6 addresses for name servers
• server-name: an unordered collection of hostnames of name servers; the addresses must be fetched separately
• include-delegparam: an unordered collection of domain names that point to DELEGPARAM RRsets, which in turn have more information about the delegation

These keys MUST have a non-empty DelegInfoValue. The presentation values for server-ipv4 and server-ipv6 are comma-separated lists of one or more IP addresses of the appropriate family in standard textual format . The wire formats for server-ipv4 and server-ipv6 are a sequence of IP addresses, in network byte order, for the respective address family. The presentation values for server-name and include-delegparam are an unordered collection of fully-qualified domain names and relative domain names, separated by commas. Relative names in the presentation format are interpreted according to the origin rules in Section 5.1 of . Parsing the comma-separated list is specified in Section A.1 of . The DELEG protocol allows the use of all valid domain names, as defined in and Section 11 of . The presentation format for names with special characters requires both double-escaping by applying rules of Section 5.1 of together with the escaping rules from Section A.1 of . For example, assume a list of two domain names. The first domain name is "simple.example". The second domain name is under ".example" whose leftmost label is "abc" followed by a escape character (U+001B), followed by "def", followed by a comma, followed by "ghi". This list would have a presentation value of "simple.example,abc\027def\,ghi.example". The wire format for server-name and include-delegparam are each a concatenated unordered collection of wire-format domain names, where the root label provides the separation between names: The names in the wire format MUST NOT be compressed, per . For interoperability with the resolver algorithm defined in , a DELEG or DELEGPARAM record that has a non-empty DelegInfos MUST have one, and only one, set of server information keys, chosen from the following:

• one server-ipv4 key
• one server-ipv6 key
• a pair consisting of one server-ipv4 key and one server-ipv6 key
• one server-name key
• one include-delegparam key

This restriction only applies to a single DELEG or DELEGPARAM record; a DELEG or DELEGPARAM RRset can have records with different server information keys. Authoritative servers MAY refuse to load zones which have a disallowed combination of keys in a single record. When using server-name or include-delegparam, the addresses for the names in the set must be fetched as if they were referenced by NS records. Because of the lack of Additional Section processing, there are no "glue" records provided for these names, so they cannot be for names inside the delegated domain. With this initial DELEG specification, servers are still expected to be reached on the standard DNS port for both UDP and TCP, 53. While a future specification is expected to address other transports using other ports, its eventual semantics are not covered here.

Metadata keys This specification defines a key which serves as a protocol extensibility mechanism, but is not directly used for contacting DNS servers. Any DELEG or DELEGPARAM record can have a key named "mandatory" which is similar to the key of the same name in . The presentation format for the value MUST be a comma-separated list of one or more valid DelegInfoKeys, either by their registered name or in the unknown-key format. The wire format for the value is a sequence of DelegInfoKey numeric values in network byte order, concatenated, in strictly increasing numeric order. The "mandatory" key is optional, but when it is present, the RR in which it appears MUST also contain all of the DelegInfoKeys referenced in its DelegInfoValue. Resolvers MUST handle non-compliant RRs as specified in . A resolver MUST NOT use an RR with a "mandatory" key in the resolution process unless all of the DelegInfoKeys referenced by the "mandatory" DelegInfoValue are supported in the resolver's implementation. See .

Signaling DELEG Support This document requires the use of the EDNS0 DE flag and its requirements from . A resolver that is DELEG-aware MUST signal in queries that it supports the DELEG protocol by setting the DE bit to 1. The DE bit set to 0 indicates the resolver is not DELEG-aware, and therefore can only be served referrals with NS records and other data according to non-DELEG specifications. Other special scenarios with DE=0 queries to DELEG-aware authorities are addressed in .

Use of DELEG Records in the Protocols The DELEG RRset MAY contain multiple records. A DELEG RRset MAY be present with or without NS or DS RRsets at the delegation point, though without NS records then DELEG-unaware software will not be able to resolve records in the delegated zone. DELEG RRsets MUST NOT appear at a zone's apex. The erroneous inclusion of DELEG RRset at zone's apex will cause DNSSEC validation failures. Servers MAY refuse to load such an invalid zone, similar to the DS RR type.

Resolvers Resolvers use DELEG records for referrals following the rules from . A resolver that is DELEG-aware MUST signal in queries that it supports the DELEG protocol by setting the DE bit to 1 (see ). This indicates that the resolver understands the DELEG semantics and does not need NS records to follow a referral. The DE bit set to 0 indicates the resolver is not DELEG-aware, and therefore can only be served referrals with NS records and other data according to non-DELEG specifications. Other special scenarios with DE=0 queries to DELEG-aware authorities are addressed in .

Delegation point types, QTYPE=DELEG DELEG RR type is one of NS-Omitting Delegation Types with special handling defined in . DELEG-unaware resolvers can get different types of answers for QTYPE=DELEG queries based on the configuration of the server, such as whether it is DELEG-aware and whether it also is authoritative for subdomains. For example, a DELEG-unaware authoritative name server which has loaded DELEG records via the unknown types mechanism would answer with them only if there were no NS records at the owner name, and answer with an NS delegation otherwise.

Populating the SLIST from DELEG and DELEGPARAM Records Each individual DELEG record inside a DELEG RRset, or each individual DELEGPARAM record in a DELEGPARAM RRset, can cause the addition of zero or more entries to SLIST. A resolver processes each individual DELEG record within a DELEG RRset, or each individual DELEGPARAM record in a DELEGPARAM RRset, using the following steps:

1. Discard all DelegInfo elements with DelegInfoKey values that are not supported by the resolver implementation. If no DelegInfo elements remain after this filtering, stop processing the record. Otherwise, continue using only the supported DelegInfo elements.
2. If a DelegInfo element with the "mandatory" DelegInfoKey is present, check its DelegInfoValue. The DelegInfoValue is a list of keys which MUST have corresponding DelegInfo elements in the record after the filtering in the previous steps. If any of the listed DelegInfo elements is not present, stop processing this record.
3. If a record has more than one type of server information key (excluding the IPv4/IPv6 case, see ), or if it has multiple server information keys of the same type, that record is malformed. Stop processing this record.
4. If any DNS name referenced by server-name key or the include-delegparam key is equal to or is a subdomain of the delegated domain (i.e. the DELEG record owner), that record is malformed. Stop processing this record. This check MUST be performed against the original owner name of the DELEG record even if the currently-processed record is a DELEGPARAM record that was included by the original DELEG record. The purpose of this check is to ensure deterministic behavior. Not performing this check would allow delegations to be reachable only with certain cache content and/or a specific algorithm for server selection from SLIST.
5. If server-ipv4 and/or server-ipv6 keys are present inside the record, copy all of the address values into SLIST. Stop processing this record.
6. If a server-name key is present in the record, resolve each name in the value into IPv4 and/or IPv6 addresses. Copy these addresses into SLIST. Stop processing this record.
7. If an include-delegparam key is present in the record, resolve each name in the value using the DELEGPARAM RR type. Recursively apply the algorithm described in this section, after checking that the maximum loop count described in has not been reached.
8. If none of the above applies, SLIST is not modified by this particular record.

Note that the resolution algorithm in section 5.3 terminates even if the SLIST is empty. A DELEG-aware resolver MAY implement lazy filling of SLIST, such as by deferring processing of remaining records, or even individual names or query types, if SLIST already has what the resolver considers a sufficiently large pool of addresses to contact. The order in which to try the servers in the final SLIST is outside the scope of this document.

Authoritative Servers The DELEG RR type defines a zone cut in a similar way as the NS RR type. section 4 applies. A notable example of this is that the occlusion (usually accidentally) created by delegation NS records would also be created by DELEG records at the same name (see ). DELEG-aware authoritative servers act differently when handling queries from DELEG-unaware clients (those with DE=0) than from DELEG-aware clients (those with DE=1). See and .

DELEG-aware Clients When the client indicates that it is DELEG-aware by setting DE=1 in the query, DELEG-aware authoritative servers treat DELEG records as delegations, and the servers are authoritative. This new zone cut has priority over a legacy delegation.

DELEG-aware Clients Requesting QTYPE=DELEG An explicit query for the DELEG RR type at a delegation point behaves much like a query for the DS RR type: the server answers authoritatively from the delegating zone. All non-DELEG specifications for the special handling of queries with QTYPE=DS apply equally to QTYPE=DELEG. In summary, the server either provides an authoritative DELEG RRset or declares its non-existence, with relevant DNSSEC proofs when requested and available.

DELEG-aware Clients with NS RRs Present but No DELEG RRs According to specification in , if the delegation does not have a DELEG RRset, the authoritative server puts the NS RRset into the authority section of the referral. The absence of the DELEG RRset needs to be proven. Similarly, rules for DS RRset inclusion into referrals apply as specified by the DNSSEC protocol. Please note that, in practice, the same process and records are used to prove the non-existence of both DELEG and DS RRsets.

DELEG-unaware Clients A general principle for DELEG-aware authoritative servers is that they respond to a DELEG-unaware client by following non-DELEG specifications. DELEG-unaware clients do not recognize DELEG records as a delegation point and are not aware of the special handling rules for DELEG records. They understand a DELEG RRset as an ordinary unknown RR type. In summary, DELEG records are not returned in referral responses to DELEG-unaware clients, and DELEG-unaware clients do not consider DELEG records authoritative at a delegation point. An authoritative server responding to DELEG-unaware clients has to handle three distinct situations:

• No DELEG RRset is present. In this case, the authoritative server follows the non-DELEG specifications.
• An NS RRset and a DELEG RRset are both present. In this case, the authoritative server uses the NS RRset when constructing referral responses, following the non-DELEG specifications. See also and .
• A DELEG RRset is present, but an NS RRset is not. This is addressed in the next section.

DELEG-unaware Clients with DELEG RRs Present but No NS RRs Authoritative servers may receive requests from DELEG-unaware clients for which the child zone is authoritative and is delegated with DELEG RRs only (that is, without any NS RRs). Such a zone is, by definition, not resolvable for DELEG-unaware clients. From the perspective of a DELEG-unaware client, the zone cut created by the DELEG RRs is invisible. The authoritative server should respond in a way that makes sense to DELEG-unaware clients. The current, primary use case for zone owners that have zones to have DELEG records but no NS records is that they want resolution of those zones only if the resolver uses future features of the DELEG protocol, such as encrypted DNS transports. The authoritative server is RECOMMENDED to supplement its responses to DELEG-unaware resolvers with an Extended DNS Error using the value "New Delegation Only" (decimal 34) from the Extended DNS Error Codes registry. When there is no NS RRset for a delegated zone, a DELEG-aware authoritative server MUST respond to DELEG-unaware clients with an answer that accurately describes the situation to a DELEG-unaware resolver. For a query of the delegated zone itself, the response has an RCODE of NOERROR; for a query that has more labels than the delegated zone, the response has an RCODE of NXDOMAIN; this is no different than the algorithm applicable to DELEG-unaware authoritative servers originally defined in (and later updated). NSEC and DS records are returned following the existing rules in .

DELEG-unaware Clients Requesting QTYPE=DELEG From the perspective of DELEG-unaware clients, the DELEG RR type does not have special semantics and should behave like an old ordinary RR type such as TXT. Thus, queries with DE=0 and QTYPE=DELEG MUST result in a response which can be validated by a DELEG-unaware client.

• If there is an NS RRset, this will be a legacy referral. From the perspective of a DELEG-unaware client, the DELEG RR is effectively occluded by NS RRset. The DELEG-unaware resolver can then obtain a final answer which can be validated from the delegated zone in similar fashion as described in Section 3.1.4.1.
• If there is no NS RRset but there is a DELEG RRset, this will be a normal authoritative response with the DELEG RRset, following non-DELEG specifications.
• If there is no NS RRset and no DELEG RRset, this will be a standard negative response following non-DELEG specifications.

The above rules apply to authoritative servers that are serving both a parent and a child zone when a DELEG-unaware client sends a QTYPE=DELEG query.

DNSSEC Signers The DELEG record is authoritative at the delegation point and needs to be signed as such. Existing rules from the DNSSEC specifications apply. These are defined in . In summary: for DNSSEC signing, treat the DELEG RR type the same way as the DS RR type. The DELEG RR type defines a zone cut in a similar way as the NS RR type. This has several consequences which stem from existing non-DELEG specifications:

• All owner names below zone cut are occluded and thus not present in NSEC chains.
• All RRsets which are not permissible at the delegation point are occluded too and not represented in NSEC chain type bitmap.

See examples in and . In order to protect validators from downgrade attacks, introduces the DNSKEY flag called DNSKEY-ADT. To achieve downgrade resistance, DNSSEC-signed zones which contain a DELEG RRset MUST follow the rules in .

Operational Considerations When DELEG is deployed, new operational considerations will apply. While the majority of these relate to the operation of DELEG-aware servers or resolvers, there is a more general set of operational practices which will need to apply because not all resolvers will be DELEG-aware. This section gives an overview of some of those considerations.

Forwarding A Validating Stub Resolver that is DELEG-aware MUST only use security-aware resolvers that are DELEG-aware. A DELEG-aware Validating Resolver that uses forwarders MUST only use DELEG-aware and security-aware forwarders. Otherwise DNSSEC-secure zones might fail to validate (see ) and DNSSEC-insecure zones might observe inconsistent answers. specifies a DNS resource record type, RESINFO, to allow resolvers to publish information about their capabilities and policies. This can be used to inform DNS clients that DELEG is supported by the DNS resolver. A resolver which supports SHOULD add the "deleg" key if it supports DELEG protocol; otherwise, a DNS client would not know that the resolver is DELEG-aware. A resolver that uses forwarders MAY use a RESINFO query to determine if the configured forwarders are DELEG-aware. Note that, per the rules for the keys defined in Section 6.4 of , if there is no '=' in a key, then it is a boolean attribute, simply identified as being present with no value.

NS Not Required by Protocol A zone delegated exclusively using DELEG records is not resolvable by non-DELEG aware resolvers. In that case the zone is not required to have an NS RRset in the apex of the delegated zone. Software to manage zone content or check the validity of zones needs to be updated to allow zones without an NS RRset at the apex.

NS Maybe Required in Practice Although DELEG removes the protocol requirement for NS records, resolver support for DELEG will not be universal for a long time after this protocol is first deployed. The deployment of DELEG-only delegation creates a new situation in which DNS servers that are authoritative for a particular set of domains provide partly or completely different answers. Where "split DNS" or "split-horizon DNS" differences depend on the source of the query, resolution of DELEG-only delegations will depend on whether or not the resolver is aware of and using DELEG. Compare examples of DELEG-only delegation and respective answers for DELEG-unaware client in and DELEG-aware client in . For any part of the namespace that is intended to be globally reachable, operators should avoid DELEG-only delegations, as some resolvers will be unaware of DELEG. For other parts of the namespace, operators should take care to ensure that any variability in responses introduced maps correctly to the client capabilities. DELEG-only delegation is appropriate only where all intended users are known to use DELEG-capable resolvers. This might be the case when a zone operator wants a zone to be reachable only over secure transport, for example. The decision to drop NS records should be guided by operational measurements of resolver adoption of the DELEG protocol.

NS and DELEG Combined This document explicitly allows zones to be delegated using DELEG records without also using NS records; delegating a zone with both DELEG and NS records is also allowed. Software that manages delegations or checks the validity of zones need to be updated to allow delegations with all combinations of (with, without) * (NS, DELEG) records. If both NS and DELEG records are present, zone managers might want to check consistency across both RRsets, subject to local policy. This specification treats both NS and DELEG RRsets as completely independent at the protocol layer, but it does not prohibit a provisioning system from generating one record type from the other.

Authoritative Deployment Before adding a first DELEG record into a DNS zone, these steps need to be taken, in this order:

1. If zone checkers are used: ensure that the zone checkers are DELEG-aware.
2. Ensure that all authoritative servers serving (and transferring) the zone are DELEG-aware.
3. If a zone is DNSSEC-signed: ensure that the signer is DELEG-aware.
4. If a zone is DNSSEC-signed: ensure that at least one DNSKEY record has the DNSKEY-ADT flag set to 1. Failure to do so results in loss of downgrade resistance of the DELEG protocol for this zone; see section 8.

Enabling the DNSKEY-ADT Flag According to the DNSSEC specification, changing flags of a DNSKEY record changes its Key Tag and thus requires a key rollover. For this reason, the DNSKEY-ADT flag cannot be simply enabled on an existing key without other changes to the record. Operators are advised to set the DNSKEY-ADT flag at the time of generating a new key, as part of a regular key rollover using established procedures. A zone can safely have keys with the DNSKEY-ADT flag set to 1 even if the zone does not have any DELEG records. Turning on the DNSKEY-ADT flag can be done months or even years before a first DELEG record is introduced into the zone. Downgrade protection is effective if any DNSKEY with ADT flag set to 1 is present, even if this key does not sign any RRset. In other words, it is sufficient to pre-publish new key, as described in stage 2 of Pre-Publish Zone Signing Key Rollover of Section 4.1.1.1. An extremely conservative approach might be:

1. Lower DNSKEY TTL to shorten time to rollback.
2. Add a new DNSKEY with ADT flag set to 1, but do not sign any RRsets with this key.
3. Monitor deployment for issues.
4. Experiment with adding DELEG records at this point, even if the key rollover is not finished. If there is a problem, withdraw the new, otherwise unused key.
5. Finish the key rollover.
6. Restore the original DNSKEY TTL.

Such an approach requires changing only the DNSKEY RRset and resigning it. Consequently, the time required to withdraw the new DNSKEY record is limited only by DNSKEY TTL + time to sign + time to transfer modified DNSKEY RRset.

Interaction with Dynamic DNS Update DELEG records can be updated like other regular zone data at the delegation point, similar to NS records, because dynamic updates work on zone data but not on queries. A DELEG-only delegation would not need an NS record in the delegated zone, but the NS record in the delegated zone cannot be deleted because of Section 7.13 in . This should cause no immediate problems because dynamic DNS updates with DELEG are most useful at the delegation point. A DELEGPARAM record will be handled like any other record.

Security Considerations

Preventing Over-work Attacks Resolvers MUST prevent situations where accidental misconfiguration of zones or malicious attacks cause them to perform too much work when resolving. This document describes two sets of actions that, if not controlled, could lead to over-work attacks. Long chains of include-delegparam information (), and those with circular chains of include-delegparam information, can be burdensome. To prevent this, the resolver MUST limit include-delegparam chain processing when populating SLIST similarly to CNAME processing in ; otherwise, the resolver could exhaust some of its resources. Note that include-delegparam chains can have CNAME/DNAME steps in them; in such a case, a CNAME step is counted the same as a DELEGPARAM step when determining when to stop following a chain. Content of SLIST MUST be deduplicated to prevent amplification attacks similar to CVE-2026-3592 which use the resolver to attack other systems. See .

Preventing Downgrade Attacks section 8 applies.

DELEG Is Stronger Than NS DELEG RRtype has stronger protection (by DNSSEC) than delegation NS records and glue records. A zone that does not need to be resolvable by DELEG-unaware clients (see ), and is delegated only with DELEG records, will have a smaller attack surface compared to a zone delegated with both DELEG and NS records. The additional attack surface of legacy delegations stems from the possibility of replacing NS and glue records in referrals with arbitrary values, which is not detectable by DNSSEC (by design in Section 2.2). For example, this allows redirecting a referral to names and/or addresses under an attacker's control. Even for DNSSEC-secure zones, an attacker can use this ability to continuously proxy queries and responses, observe traffic, and also monitor the network addresses involved, which might be a privacy concern for roaming clients. The feasibility and impact of such attacks depend on the threat model, which is outside the scope of this document.

IANA Considerations

Changes to Existing Registries All new allocations should reference this document. IANA is requested to assign two types in the Resource Record (RR) TYPEs registry ():

• TYPE DELEG, Meaning "Extensible Delegation", from the NS-Omitting Delegation Types range defined in . The requested value is 61440.
• TYPE DELEGPARAM, Meaning "Extensible Delegation Indirection", Value TBD2 inside one of the ranges marked as "data TYPEs".

IANA is requested to assign a value in the Extended DNS Error Codes registry ():

• Decimal 34 with the Purpose "New Delegation Only".

IANA is requested to create this assignment in the DNS Resolver Information Keys registry (): Name "deleg", Description "The presence of the key indicates that the DELEG protocol is supported."

New Registry for Delegation Information IANA is requested to create the "DELEG Delegation Information" registry. This registry defines the namespace for delegation information keys, including string representations and numeric key values.

Procedure A registration MUST include the following fields: To enable code reuse from SVCB parsers, the requirements for registered Name exactly copy requirements set by Section 14.3.1: The characters in the registered Name field entry MUST be lowercase alphanumeric or "-". The name MUST NOT start with "key" or "invalid". The registration policy for new entries is Expert Review (). The designated expert MUST ensure that the reference is stable and publicly available and that it specifies how to convert the delegation information's presentation format to wire format. The reference MAY be any individual's Internet-Draft or a document from any other source with similar assurances of stability and availability. An entry MAY specify a reference of the form "Same as (other key name)" if it uses the same presentation and wire formats as an existing key. This arrangement supports the development of new parameters while ensuring that zone files can be made interoperable.

Initial Contents The "DELEG Delegation Information" registry should be populated with the following initial registrations:

References Normative References ICANN PowerDNS ISC The Domain Name System (DNS) protocol permits Delegation Signer (DS) records at delegation points. This document specifies modifications to the DNS protocol to permit a range of Resource Record types at delegation points. These modifications are designed to maintain compatibility with existing DNS resolution mechanisms and provide a secure method for processing these records at delegation points. This document updates RFCs 1034, 4035, 6672, 6840, 6895 and 9824. This document specifies the "SVCB" ("Service Binding") and "HTTPS" DNS resource record (RR) types to facilitate the lookup of information needed to make connections to network services, such as for HTTP origins. SVCB records allow a service to be provided from multiple alternative endpoints, each with associated parameters (such as transport protocol configuration), and are extensible to support future uses (such as keys for encrypting the TLS ClientHello). They also enable aliasing of apex domains, which is not possible with CNAME. The HTTPS RR is a variation of SVCB for use with HTTP (see RFC 9110, "HTTP Semantics"). By providing more information to the client before it attempts to establish a connection, these records offer potential benefits to both performance and privacy. This RFC is the revised specification of the protocol and format used in the implementation of the Domain Name System. It obsoletes RFC-883. This memo documents the details of the domain name client - server communication. This document considers some areas that have been identified as problems with the specification of the Domain Name System, and proposes remedies for the defects identified. [STANDARDS-TRACK] This RFC is the revised basic definition of The Domain Name System. It obsoletes RFC-882. This memo describes the domain style names and their used for host address look up and electronic mail forwarding. It discusses the clients and servers in the domain name system and the protocol used between them. Extending the Domain Name System (DNS) with new Resource Record (RR) types currently requires changes to name server software. This document specifies the changes necessary to allow future DNS implementations to handle new RR types transparently. [STANDARDS-TRACK] This document defines an extensible method to return additional information about the cause of DNS errors. Though created primarily to extend SERVFAIL to provide additional information about the cause of DNS and DNSSEC failures, the Extended DNS Errors option defined in this document allows all response types to contain extended error information. Extended DNS Error information does not change the processing of RCODEs. This document is part of a family of documents that describe the DNS Security Extensions (DNSSEC). The DNS Security Extensions are a collection of new resource records and protocol modifications that add data origin authentication and data integrity to the DNS. This document describes the DNSSEC protocol modifications. This document defines the concept of a signed zone, along with the requirements for serving and resolving by using DNSSEC. These techniques allow a security-aware resolver to authenticate both DNS resource records and authoritative DNS error indications. This document obsoletes RFC 2535 and incorporates changes from all updates to RFC 2535. [STANDARDS-TRACK] This document specifies a method for DNS resolvers to publish information about themselves. DNS clients can use the resolver information to identify the capabilities of DNS resolvers. How DNS clients use such information is beyond the scope of this document. This document specifies how DNS resource records are named and structured to facilitate service discovery. Given a type of service that a client is looking for, and a domain in which the client is looking for that service, this mechanism allows clients to discover a list of named instances of that desired service, using standard DNS queries. This mechanism is referred to as DNS-based Service Discovery, or DNS-SD. This document describes a set of practices for operating the DNS with security extensions (DNSSEC). The target audience is zone administrators deploying DNSSEC. The document discusses operational aspects of using keys and signatures in the DNS. It discusses issues of key generation, key storage, signature generation, key rollover, and related policies. This document obsoletes RFC 4641, as it covers more operational ground and gives more up-to-date requirements with respect to key sizes and the DNSSEC operations. Using this specification of the UPDATE opcode, it is possible to add or delete RRs or RRsets from a specified zone. Prerequisites are specified separately from update operations, and can specify a dependency upon either the previous existence or nonexistence of an RRset, or the existence of a single RR. [STANDARDS-TRACK] This document specifies Internet Assigned Numbers Authority (IANA) parameter assignment considerations for the allocation of Domain Name System (DNS) resource record types, CLASSes, operation codes, error codes, DNS protocol message header bits, and AFSDB resource record subtypes. It obsoletes RFC 6195 and updates RFCs 1183, 2845, 2930, and 3597. Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. Informative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. The Domain Name System (DNS) is defined in literally dozens of different RFCs. The terminology used by implementers and developers of DNS protocols, and by operators of DNS systems, has changed in the decades since the DNS was first defined. This document gives current definitions for many of the terms used in the DNS in a single document. This document updates RFC 2308 by clarifying the definitions of "forwarder" and "QNAME". It obsoletes RFC 8499 by adding multiple terms and clarifications. Comprehensive lists of changed and new definitions can be found in Appendices A and B. As IPv6 deployment increases, there will be a dramatic increase in the need to use IPv6 addresses in text. While the IPv6 address architecture in Section 2.2 of RFC 4291 describes a flexible model for text representation of an IPv6 address, this flexibility has been causing problems for operators, system engineers, and users. This document defines a canonical textual representation format. It does not define a format for internal storage, such as within an application or database. It is expected that the canonical format will be followed by humans and systems when representing IPv6 addresses as text, but all implementations must accept and be able to handle any legitimate RFC 4291 format. [STANDARDS-TRACK] This MIB module defines textual conventions to represent commonly used Internet network layer addressing information. The intent is that these textual conventions will be imported and used in MIB modules that would otherwise define their own representations. [STANDARDS-TRACK] Akamai Technologies Within the DNS, there is no mechanism for authoritative servers to advertise which transport methods they are capable of. If secure transport methods are adopted by authoritative operators, transport signaling would be required to negotiate how authoritative servers would be contacted by resolvers. This document provides two new Resource Record Types, NS2 and NS2T, to facilitate this negotiation by allowing zone owners to signal how the authoritative nameserver(s) for their zone(s) may accept queries.

Examples

Root zone file The following example shows an excerpt from a signed root zone. It shows the delegation point for "example." and "test." The "example." delegation has DELEG and NS records. The "test." delegation has DELEG but no NS records. The "test." delegation point has a DELEG record and no NS or DS records. Please note: This is an example of an unnecessarily complicated setup to demonstrate the capabilities of the DELEG and DELEGPARAM RR types. Delegations to org and net zones omitted for brevity.

Example.org zone file The following example shows an excerpt from an unsigned example.org zone.

Example.net zone file The following example shows an excerpt from an unsigned example.net zone.

Responses The following sections show referral examples:

DO bit clear, DE bit clear

Query for foo.example

Query for foo.test See .

Query for a.test A forgotten glue record under the "test." delegation point is occluded by DELEG RRset.

DO bit set, DE bit clear

Query for foo.example

Query for foo.test See . DELEG-unaware validators would treat this answer as DNSSEC-secure. DELEG-aware validators would treat it as DNSSEC-bogus because the DELEG bit in NSEC type bitmap would trigger downgrade attack detection (see section 6).

Query for a.test A forgotten glue record under the "test." delegation point is occluded by DELEG RRset. This is indicated by NSEC chain which "skips" over the owner name with A RRset.

DO bit clear, DE bit set

Query for foo.example

Query for foo.test A follow-up example in explains the ultimate meaning of this response.

DO bit set, DE bit set

Query for foo.example

Query for foo.test A follow-up example in explains the ultimate meaning of this response.

DELEGPARAM Interpretation In the examples above, the test. DELEG record uses indirection and points to other domain names with DELEGPARAM, A, AAAA, and CNAME records. During resolution, a resolver will gradually build set of name servers to contact, as defined in . To visualize the end result of this process, the full set of name servers in form of a 'virtual' DELEG RRset is represented here. Note the "cname.example.org." value in "include-delegparam=Acfg.example.org.,cname.example.org." DELEG record has no visible effect. The included name loops via CNAME back to "Acfg.example.org." which is already included. This would have caused duplication of all values if each SLIST was not treated as a set. Implementations are free to use alternative representations for this data, as it is not directly exposed via DNS protocol.

An example of a valid delegation tree Each delegation level can have a mixture of DELEG and NS RR types, and DELEG-aware resolvers must be able to follow chains of delegations which combines both types in arbitrary ways.

Failure Cases Several examples of misconfigured delegations which cannot be resolved follow. Self-references to names without any addresses: Cycles: Syntactically valid DELEG records without any keys: DELEG records with disallowed/ambiguous combination of keys: A delegation missing the value for a mandatory key: Records which are not even allowed in zone file (see also appendix D.3) but might be sent in wire format:

Test Vectors These test vectors only contain the RDATA portion of DELEG records in presentation format, generic format () and wire format. The wire format uses hexadecimal (\xNN) for each non-ascii byte. As the wireformat is long, it is broken into several lines. As the encoding rules for DelegInfo and SVCParam are the same, further examples of the encoding of different types of values can be found in Appendix D of .

A simple example of a mandatory server-ip4 with two IP addresses

Two quoted server-ipv6 addresses

The server-name deleg info with two addresses with different capitalization

The include-delegparam deleg info with a single value

Acknowledgments This document is heavily based on past work done by Tim April in and thus extends the thanks to the people helping on this which are: John Levine, Erik Nygren, Jon Reed, Ben Kaduk, Mashooq Muhaimen, Jason Moreau, Jerrod Wiesman, Billy Tiemann, Gordon Marx and Brian Wellington. Work on DELEG protocol has started at IETF 118 Hackathon. Hackathon participants: Christian Elmerot, David Blacka, David Lawrence, Edward Lewis, Erik Nygren, George Michaelson, Jan Včelák, Klaus Darilion, Libor Peltan, Manu Bretelle, Peter van Dijk, Petr Špaček, Philip Homburg, Ralf Weber, Roy Arends, Shane Kerr, Shumon Huque, Vandan Adhvaryu, Vladimír Čunát, Andreas Schulze. Other people joined the effort after the initial hackaton: Ben Schwartz, Bob Halley, Paul Hoffman, Miek Gieben, Ray Hunter, Håvard Eidnes, Ted Hardie, Michael Richardson, Florian Obser, Evan Hunt, Pieter Lexis, ...