This domain is protected with DNSSEC algorithm 16 (Ed448). It is hosted at domainname.shop. They sign all their zones using DNSSEC by default.

Ed448 was standardized for use with DNSSEC in February 2017 (RFC8080) and has been a RECOMMENDED algorithm since June 2019 (RFC8624). It has been supported in the .no zone since February 2020. The latest stable versions of OpenSSL (3.x) fully support Ed448. All older versions (including 1.1.1, 1.1.0, 1.0.2 and 1.0.0) are now out of support and users of these older versions are encouraged to upgrade to 3.x as soon as possible.

Ed448 is an Edwards-curve Digital Signature Algorithm (EdDSA). Like other ellipctic curve algorithms, its main advantage over RSA is that it offers the same level of security with much shorter key lengths, leading to shorter DNSKEY and RRSIG records. This in turn means that most DNS responses will fit in a single UDP packet (<512 bytes), and the potential for DNS amplification DDoS attacks is greatly reduced. EdDSA also has a number of advantages over ECDSA algorithms such as DNSSEC algorithm 13 (ECDSA P-256) and 14 (ECDSA P-384): it is faster, it is not dependent on a unique random number when generating signatures, it is more resilient to side-channel attacks, and it is easier to implement correctly.

Key length vs. security

AlgorithmDNSSEC algorithm numberSecurity level (bits)DNSKEY length (bytes)Sample DNSKEY (base64)
AwEAAezl4fatziafieMI54HzXz9BF3GXjCKn0Z5x/gLLe2fVBvIbQcwRPaDf2QMxXaO8gCV1GofAn+DiRyUl9rB3K/8l7RRTHqh8PLtMCgKMOgnMoAb7+3X3v1C\ fDv/4JhFOo0BekT6gX2pV2/EfK2Fi7JJAfbyaI/CrxX9M0k78Rcoz
AwEAAbsb7WU7gV6tnzHJhWul76MYRNpiaYLL7hHKzAR2XSyYD+nNRAgd+Ho9kNHacN4kMsZ/krE0/NtFowpiiufl+FnSeYgbCaWzoyAPEn4IkvDBPv/4uF6AfO\ CtzPi8zmWgY56KPXsALo8bFuxWMzxcwMxoW29N2Va297vFA4Qul5eYUoPsTOP4OnWYJTRh4qS7cDYausDfJZF2tpH7vufDgloTbs+HfjLqjf012ueiLCV/qGbaRffa4fNB8oTl4BTFvlUWUTtWw3zCRNrAXlK050vV9FvqCXUAcddxcJ\ ui0oH5++N2/MwY0GoyE1g2+gTeoJqZxeUSAErE3lyNby6eERs=
AwEAAd2UmZElsfz+6SYrfNhjd9PNIdXAerDJp0uSsjJIavVZt4O26PosRq3qvu1LQ9WNjfS17wvOeALD+i96LDqLPRSIxR7vq636gvreYenhmGxEb4qiTglnQk\ AlbvMwkyPKqdD5zyBcR/Er90Sfy+1lKtsUIQydDJcsjp6jHf6e31hsLhmDspjnAQKPdL+BWItnNE/oGAJeJI2F2uulC1NYIMl8+/sV5ERMzuqpxnixSMASQhGQlpZO7pJaCKi//ov1zzWSaDkQa/OdIirOQl06fgrMuxUdVe+W1dc17r\ oCLqVivmB7McvTeXVVEynsJeGoCFzeAVO0uCot3WTXOWKpNLOvsdpoun15Q+w5ZWei6+JT5P+iJ8UMcYJeh8QwXKk+wBurjZgEurkP9oRNXJfoi1UUIlDH6fCsaCE7k7Cb/NjMr6nmhZgIHpnFACuOEO6p36ws5BoV+AVACmyiPDpWI2\ 5tHjnSLhGXVpJyoQjOvQujivU8IDn7rumvk4nn7C5k3Q==
ECDSA P-2561312864
ECDSA P-3841419296
mfdcZ1hUF8YW8qFqfJs498QeZ2eS30h2od0q7DVH/HLHTqwOfliC1qnem3zCt0XeNrgS/kTt8lp/eRzu+/Y+Zy7dKP+TupWq72QkWZSGNVtryCiyYRD\ 5jrO1oH+wt1Ao

Resolver support

Here is a list of current DNSSEC algorithms that your resolver supports, courtesy of rootcanary.org.

8: RSA-SHA256
10: RSA-SHA512
13: ECDSA P-256
14: ECDSA P-384
15: Ed25519
16: Ed448

OK DNSSEC validation succeeded for this DS and signing algorithm combination
NO This DS and signing algorithm combination are not validated by your resolver(s)
KO This DS and signing algorithm lead to a SERVFAIL

Worldwide deployment

The DNSThough project by NLnet Labs measures worldwide DNSSEC algorithm support and publishes updated statistics at regular intervals.

Tools for DNSSEC validation

Here is a collection of tools to verify that DNSSEC has been correctly configured for a particular zone:

See also

Below are a few links for further reading: