Domain Name System Security (DNSSEC) Algorithm Numbers

Created

• 2003-11-03

Last Updated

• 2026-08-10

Available Formats

• XML
• HTML
• TXT

DNS Security Algorithm Numbers

Registration Procedure(s)

• Standards Action or Specification Required

Expert(s)

• Mark Andrews, Roy Arends, Warren Kumari, Wes Hardaker

Reference

• RFC 4034: Resource Records for the DNS Security Extensions
• RFC 3755: Legacy Resolver Compatibility for Delegation Signer (DS)
• RFC 6014: Cryptographic Algorithm Identifier Allocation for DNSSEC
• RFC 6944: Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
• RFC 9904: DNSSEC Cryptographic Algorithm Recommendation Update Process

Note

Adding a new entry to the "DNS Security Algorithm Numbers” registry with a recommended value of "MAY" in the "Use for DNSSEC Signing", "Use for DNSSEC Validation", "Implement for DNSSEC Signing", or "Implement for DNSSEC Validation" columns will be subject to the Specification Required policy as defined in RFC 8126 in order to promote continued evolution of DNSSEC algorithms and DNSSEC agility. New entries added through the Specification Required process will have the value of "MAY” for all columns.

Adding a new entry to, or changing an existing value in, the “DNS Security Algorithm Numbers" registry that has any value other than "MAY" in the "Use for DNSSEC Signing", "Use for DNSSEC Validation", "Implement for DNSSEC Signing", or "Implement for DNSSEC Validation" columns requires Standards Action.

If an item is not marked as "RECOMMENDED", it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases.

Note

The KEY, SIG, DNSKEY, RRSIG, DS, and CERT RRs use an 8-bit number used to identify the security algorithm being used.

All algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. Only algorithms usable for zone signing may appear in DNSKEY, RRSIG, and DS RRs. Only those usable for SIG(0) and TSIG may appear in SIG and KEY RRs.

(*) There has been no determination of standardization of the use of this algorithm with Transaction Security.

Available Formats

• CSV

DNS KEY Record Diffie-Hellman Prime Lengths

Registration Procedure(s)

• IETF Review

Reference

• RFC 2539: Storage of Diffie-Hellman Keys in the Domain Name System (DNS)

Available Formats

• CSV

DNS KEY Record Diffie-Hellman Well-Known Prime/Generator Pairs

Reference

• RFC 2539: Storage of Diffie-Hellman Keys in the Domain Name System (DNS)

Available Formats

• CSV