CDS/DS mismatch shown by dnsviz.net

Managed DNS Hosting
1

deSEC computes DS using two digest algorithms per key — SHA-256 (digest type 2) and SHA-384 (digest type 4).

However, only the type 2 DS record is show on the domain page.

When I enter only the type 2 DS record at my registrar, dnsviz.net shows the following warning:

/CDS: The contents of the DS RRset are inconsistent with those of the CDS RRset. See RFC 7344, Sec. 3, RFC 7344, Sec. 5.

I found out about the two types by running:

dig CDS <domain> @ns1.desec.io +short

After adding the second DS record, the warning is gone.

Perhaps the domain overview on desec should show both DS keys?

2

I think DNSViz is overly strict here, and this has come up before.

fiwswe

1 Like
3

Thank you, and indeed it had been mentioned before. My apologies for the noise.

I finally found the search button, too! Couldn’t find it the other day.