NAME

DESCRIPTION

• If there exists DS at parent, the child must use DNSSEC.
• If there exists DNSKEY at child, the parent should have a DS.
• A DNSSEC key should not be of type RSA/MD5.
• At least one DNSKEY should be of type RSA/SHA1.
• There may exist a SEP at the child.
• RRSIG(DNSKEY) must be valid and created by a valid DNSKEY.
• RRSIG(SOA) must be valid and created by a valid DNSKEY.
• The DS must point to a DNSKEY signing the child's DNSKEY RRset.
• The DS may point to a SEP at the child.
• At least one DS algorithm should be of type RSA/SHA1.

METHODS

->test($zonename)

->rrsig_validities($zonename)

EXAMPLES

SEE ALSO