2 ms·

> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet

> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se https://internet.nl/site/netnod.se

Stitch4223 29d ago
Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176
- traceroute66 29d ago
  Super, thanks. zonemaster added to my bookmarks !
  - pawal 28d ago
    Also have a look at gonemaster, the modern replacement: https://gonemaster.evilbit.de/ https://gonemaster.evilbit.de/

Stitch4223 29d ago

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176

traceroute66 29d ago
Super, thanks. zonemaster added to my bookmarks !
- pawal 28d ago
  Also have a look at gonemaster, the modern replacement: https://gonemaster.evilbit.de/ https://gonemaster.evilbit.de/