DNSKEYRecordValidator
class DNSKEYRecordValidator implements DnsRecordValidatorInterface (View source)
DNSKEY record validator
DNSKEY records are defined in RFC 4034 and store public keys that are used in the DNSSEC authentication process. These records contain the public key material that verifiers need to authenticate DNSSEC signatures in RRSIG records.
Format:
- flags: 16-bit field represented as an unsigned decimal number (0, 256, or 257)
- bit 7: Zone Key flag (1 for KSK/ZSK, 0 for other purposes)
- bit 15: Secure Entry Point (SEP) flag (RFC 3757), often set for KSKs (1 for KSK)
- 256 (0x0100): Zone Key flag set (ZSK)
- 257 (0x0101): Zone Key flag + SEP flag set (KSK)
- 0: Neither flag set (not for DNSSEC)
- protocol: Must be 3 (fixed value, retained for compatibility with KEY record)
- algorithm: DNSSEC algorithm number (1-16, with RFC 8624 recommendations)
- public-key: Base64 encoded public key material (format depends on algorithm)
Methods
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates DNSKEY record content
Details
__construct(ConfigurationManager $config)
No description
ValidationResult
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates DNSKEY record content