RKEYRecordValidator
class RKEYRecordValidator implements DnsRecordValidatorInterface (View source)
RKEY (Resource KEY) record validator
Validates RKEY records according to:
- Internet-Draft: draft-reid-dnsext-rkey-00 (The RKEY DNS Resource Record)
- RFC 4034: Format for the flags, protocol, and algorithm fields
RKEY records are designed to store public keys used for encrypting DNS resource records, primarily intended for encrypting NAPTR records, though they can be used more generally. The format is borrowed from DNSKEY records defined in RFC 4034.
Format:
Example: 256 3 8 AwEAAbDIfjfFKkP0arI0+27YF8yJzt2+VM1NFRGMbl4dbExs+eK7
Where:
- flags: 16-bit field (typically 256 or 257)
- Bit 7 (Zone Key flag): If set, the key is a zone key
- Bit 0 (SEP flag): If set, this is a secure entry point
- protocol: Must be 3 for backward compatibility
- algorithm: DNSSEC algorithm number (same as in RFC 4034)
- 1 = RSA/MD5 (deprecated, RFC 6725)
- 3 = DSA/SHA1 (insecure)
- 5 = RSA/SHA-1 (insecure)
- 7 = RSASHA1-NSEC3-SHA1
- 8 = RSA/SHA-256 (recommended)
- 10 = RSA/SHA-512
- 13 = ECDSA Curve P-256 with SHA-256
- 14 = ECDSA Curve P-384 with SHA-384
- 15 = Ed25519
- 16 = Ed448
- public-key: Base64 encoded public key data
Important notes:
- This record was never formally standardized as an RFC
- Modern implementations rarely use RKEY records
- This record borrows format from DNSKEY but serves a different purpose
- Type code assignment was requested from IANA in the Internet-Draft
Methods
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates RKEY record content
Details
__construct(ConfigurationManager $config)
No description
ValidationResult
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates RKEY record content