[dd] DS-pinning and Alias mode limitation

[Roy Arends <[e-mail]>]

I understand that DS pinning involves DS material that references a DNSKEY, uniquely tied to a {zone-name-server} pair.

It's important to note that the digest in a DS record is generated based on the DNSKEY owner name and DNSKEY RDATA.

DS pinning won't function properly in DELEG Alias Mode when the target serves multiple zones. For instance:

foo.example DELEG 0 generic.example.net
bar.example DELEG 0 generic.example.net
generic.example.net SVCB 1 …. ds=AABBCC ns=ns1example.net

In this scenario, there must either be a unique 1:1 pairing between the DELEG owner and target name (instead of N:1), or the requirement for the digest to contain the DNSKEY owner name must be eliminated for aliased pinned DS to work effectively.

Warmly,

Roy