Subject: [dnsext] Protocol Action: 'Automated Updates of DNSSEC Trust Anchors' to Internet Standard (RFC 5011)

From: IESG Secretary <[email-masked]>
Date: Thu, 03 Jan 2013 09:32:30 -0800

The IESG has approved the following document:

- 'Automated Updates of DNS Security (DNSSEC) Trust Anchors,'
   RFC 5011 as an Internet Standard.

This document is the product of the DNS Extensions Working Group. 

A URL of this document is:
https://datatracker.ietf.org/doc/rfc5011/

Abstract: 

   This document describes a means for automated, authenticated, and
   authorized updating of DNSSEC "trust anchors".  The method provides
   protection against N-1 key compromises of N keys in the trust point
   key set.  Based on the trust established by the presence of a current
   anchor, other anchors may be added at the same place in the
   hierarchy, and, ultimately, supplant the existing anchor(s).

   This mechanism will require changes to resolver management behavior
   (but not resolver resolution behavior), and the addition of a single
   flag bit to the DNSKEY record.