Automated KEYSET management

CZ.NIC is implementing automated DNSSEC management in accordance with RFC 7344 and RFC 8078 .

Once a day, the system scans all domains in the CZ zone and attempts to find a CDNSKEY record. The process for handling the record varies depending on whether the domain is already secured with DNSSEC or not. This test is then repeated for eight to ten days.

If the result of a test differs from previous results, the process is halted and the technical contact is notified. If the status remains unchanged for at least eight days, a new KeySet with the prefix "AUTO-" is created from the contents of CDNSKEY and assigned to the domain. The status blocking changes to the domain (serverUpdateProhibited) does not prevent the AKM system from applying CDNSKEY records to the domain.

If a CDNSKEY record is found for a domain that is already secured, the authenticity of that record is verified using DNSSEC response validation.

If this domain already has an automated KeySet from a previous run, only the contents of the KeySet will be replaced with the contents of CDNSKEY. If the domain has a different KeySet, a new KeySet with the prefix "AUTO-" will be created, and this new KeySet will be added to the domain in place of the existing one.

However, if the CDNSKEY record contains "0 3 0 0," the KeySet will be removed from the domain.

You can find more information in FRED registration system documentation .