TKEYRecordValidator

TKEY (Transaction KEY) record validator

Validates TKEY records according to:

• RFC 2930: Secret Key Establishment for DNS (TKEY RR)
• RFC 3645: Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG)

TKEY records are used to establish shared secret keys between DNS resolvers and servers. These shared keys can then be used with TSIG for transaction authentication.

Format:

Example: hmac-sha256.example.com. 1609459200 1640995200 3 0 MTIzNDU2Nzg5MA==

Where:

• algorithm-name: Domain name identifying the algorithm (e.g., hmac-sha256.example.com.)
• inception-time: Start time for validity as Unix timestamp or YYYYMMDDHHmmSS format
• expiration-time: End time for validity as Unix timestamp or YYYYMMDDHHmmSS format
• mode: Key establishment method (1-5):
  • 1: Server assignment
  • 2: Diffie-Hellman exchange
  • 3: GSS-API negotiation (RFC 3645)
  • 4: Resolver assignment
  • 5: Key deletion
• error: DNS RCODE value (0-23, 0 = no error)
• key-data: Base64 or hex encoded key material

Important specifications:

• TTL should always be zero (TKEY records must not be cached)
• CLASS should be ANY (255)
• For GSS-API mode, inception and expiration times are ignored
• Each key name can only have one set of keying material active at a time

Security considerations:

• Key deletion operations MUST be authenticated (typically with TSIG)
• TKEY-established keys are associated with DNS servers/resolvers, not zones
• The GSS-API mode (3) provides built-in authentication during key exchange
• For Diffie-Hellman mode (2), external authentication like TSIG or SIG(0) is required