Solved by #1189 (implemented by zonemaster/zonemaster-engine#1304 in v2023.2).

Regarding the new modification on the test case DNSSEC03, what is the expected behavior now if the NSEC3 Parameter Settings in the zone do not comply with RFC 9276? Will it trigger a warning? Does it make sense for the recommendation to be just a warning without failing the test?

You can find all the messages (and their severity level) in the test case in the specification. See here (from #1189). Regarding non-compliant (i.e. illegal) values, this is what is currently specified:

DS03_ILLEGAL_HASH_ALGO             | ERROR   | ns_list, algo_num | The following servers respond with an illegal hash algorithm for NSEC3 ({algo_num}). Fetched from name servers "{ns_list}".
DS03_ILLEGAL_ITERATION_VALUE       | ERROR   | ns_list, int | The following servers respond with the NSEC3 iteration value {int}. The recommended practice is to set this value to 0. Fetched from name servers "{ns_list}".
DS03_ILLEGAL_SALT_LENGTH           | WARNING | ns_list, int | The following servers respond with a non-empty salt in NSEC3 ({int} octets). The recommended practice is to use an empty salt. Fetched from name servers "{ns_list}".

Uh oh!

support RFC 9276-guidance for NSEC3 in DNSSEC03 testcase #1177

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions