1.1.1.1 now supports RFC 8509 root key trust anchor sentinels
1.1.1.1 resolver now supports RFC 8509 root key trust anchor sentinels, allowing you to verify whether the resolver trusts a specific DNSSEC root key ahead of a key rollover. This enables testing for DNSSEC root key readiness using special sentinel domain queries.
1.1.1.1 now supports RFC 8509 ↗ root key trust anchor sentinels. They let you check whether the responding resolver trusts a DNSSEC root key ahead of a key rollover.
To check for KSK-2024 (key tag 38696), query DNSSEC-signed names in dnstest.dev:
# On a sentinel-aware resolver that trusts KSK-2024:
# Returns NOERROR with an A answer.
dig @1.1.1.1 root-key-sentinel-is-ta-38696.dnstest.dev. A +noall +comments +answer
# Returns SERVFAIL without an answer.
dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +noall +comments +answer
# CD bypasses sentinel processing and returns the original A answer.
dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +cdflag +noall +comments +answerFor background on DNSSEC validation, refer to DNSKEY.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare One Client for Windows hotfix - trusted certificate chains
A new GA release for Windows Cloudflare One Client is available, addressing an issue with building trusted certificate chains.
Cloudflare One Client for macOS - Trusted Certificate Chain Fix
A new GA release of the macOS Cloudflare One Client is available. This hotfix addresses an issue with building trusted certificate chains.
Cloudflare One Client for Linux
A new GA release of Cloudflare One Client for Linux is now available. This hotfix addresses an issue with building trusted certificate chains.