Registrar only supports KSK, not DS

Managed DNS Hosting
4

Hi @some-user.

I think @peter is referring to RFC 8624 Section 3.3 DS and CDS Algorithms. Your list is more similar to (but not matching) Section 3.1 DNSKEY Algorithms of the same RFC?

And yes the output of e.g. dig(1) would list the algorithm used for the DS hash in the third position after the the “DS” record type:

$ dig desec.io DS
…
;; ANSWER SECTION:
desec.io.		43315	IN	DS	6454 8 1 24396E17E36D031F71C354B06A979A67A01F503E
desec.io.		43315	IN	DS	6454 8 2 5CBA665A006F6487625C6218522F09BD3673C25FA10F25CB18459AA1 0DF1F520
…
$

Here the “1” in the first and the “2” in the second record are the algorithms used for calculating the DS hash. 1: SHA-1, 2: SHA-256. The “8” is the algorithm used for the referenced DNSKEY with key id “6454” (8: RSASHA256).

That being said, going back to your original question:

So it seems they actually want the public key, not the DS record. This is ok, as a DS record can be calculated from the key. @peter essentialy answered the same question here: My domain provider does not support DS Records!? - #2 by fiwswe.

I’ll let @peter handle your critisism of the documentation but I think I can guess his response, as this is an open source project :wink:

HTH

fiwswe