ZONEMDRecordValidator

ZONEMD (Message Digest for DNS Zones) Record Validator

Implementation based on RFC 8976: "Message Digest for DNS Zones".

The ZONEMD resource record provides a cryptographic message digest over DNS zone data at a specific point in time, thereby enabling the recipient to verify the zone contents for data integrity and authenticity.

Format:

Components:

• Serial: 32-bit unsigned integer matching the zone's SOA serial when the digest was calculated
• Scheme: 8-bit unsigned integer (1 = Simple ZONEMD scheme)
• Hash Algorithm: 8-bit unsigned integer indicating the cryptographic hash algorithm (1 = SHA-384, 2 = SHA-512)
• Digest: Hexadecimal representation of the digest value; exact length depends on the hash algorithm

Key requirements:

• Must be located at the zone apex (SOA owner name)
• Serial must match the zone's SOA serial number
• Only Scheme 1 is standardized; values 240-255 are reserved for private use
• SHA-384 (1) and SHA-512 (2) are the only standardized hash algorithms
• Digest length must match the output size of the hash algorithm (96 hex chars for SHA-384, 128 for SHA-512)

Security note: ZONEMD provides no protection against attacks on unsigned zones. For integrity protection, zones should be signed with DNSSEC.