gryphius / dnssecscore_backend Goto Github PK

• check if zone has at least one DNSKEY with SEP bit set
• check if DS only points to DNSKEY with SEP bit set
• check if DNSKEY RRSET is only signed with keys which have the SEP bit set

note: RFC 3757 makes it clear that the SEP bit is only intended for publishing the indended use of a key, it should not be considered when performing validation. However, as our testset is about best pratices, we should complain if the reality does not reflect the published intended use. (for example a DS points to a ZSK instead of a KSK or if the DNSKEY rrset is signed with a ZSK)

DS can also point to ZSKs. It is ugly, but we've seen it and it is allowed by rfc3757, so we should also check those hashes.

it would be nice if we could run the testset from command line without requiring all the web (flask) fluff.