5: RSA-SHA1
7: RSA-SHA1-NSEC3
8: RSA-SHA256
10: RSA-SHA512
13: ECDSA P-256
14: ECDSA P-384
15: Ed25519
16: Ed448
This domain is protected with DNSSEC algorithm 16 (Ed448). It is hosted at domainname.shop. They sign all their zones using DNSSEC by default.
Ed448 was standardized for use with DNSSEC in February 2017 (RFC8080) and has been a RECOMMENDED algorithm since June 2019 (RFC8624). It has been supported in the .no zone since February 2020. The latest stable versions of OpenSSL (3.x) fully support Ed448. All older versions (including 1.1.1, 1.1.0, 1.0.2 and 1.0.0) are now out of support and users of these older versions are encouraged to upgrade to 3.x as soon as possible.
Ed448 is an Edwards-curve Digital Signature Algorithm (EdDSA). Like other ellipctic curve algorithms, its main advantage over RSA is that it offers the same level of security with much shorter key lengths, leading to shorter DNSKEY and RRSIG records. This in turn means that most DNS responses will fit in a single UDP packet (<512 bytes), and the potential for DNS amplification DDoS attacks is greatly reduced. EdDSA also has a number of advantages over ECDSA algorithms such as DNSSEC algorithm 13 (ECDSA P-256) and 14 (ECDSA P-384): it is faster, it is not dependent on a unique random number when generating signatures, it is more resilient to side-channel attacks, and it is easier to implement correctly.
| Algorithm | DNSSEC algorithm number | Security level (bits) | DNSKEY length (bytes) | Sample DNSKEY (base64) |
|---|---|---|---|---|
| RSA-1024 | 5/7/8/10 | 80 | 132 | AwEAAezl4fatziafieMI54HzXz9BF3GXjCKn0Z5x/gLLe2fVBvIbQcwRPaDf2QMxXaO8gCV1GofAn+DiRyUl9rB3K/8l7RRTHqh8PLtMCgKMOgnMoAb7+3X3v1C\
fDv/4JhFOo0BekT6gX2pV2/EfK2Fi7JJAfbyaI/CrxX9M0k78Rcoz |
| RSA-2048 | 5/7/8/10 | 112 | 260 | AwEAAbsb7WU7gV6tnzHJhWul76MYRNpiaYLL7hHKzAR2XSyYD+nNRAgd+Ho9kNHacN4kMsZ/krE0/NtFowpiiufl+FnSeYgbCaWzoyAPEn4IkvDBPv/4uF6AfO\
CtzPi8zmWgY56KPXsALo8bFuxWMzxcwMxoW29N2Va297vFA4Qul5eYUoPsTOP4OnWYJTRh4qS7cDYausDfJZF2tpH7vufDgloTbs+HfjLqjf012ueiLCV/qGbaRffa4fNB8oTl4BTFvlUWUTtWw3zCRNrAXlK050vV9FvqCXUAcddxcJ\
ui0oH5++N2/MwY0GoyE1g2+gTeoJqZxeUSAErE3lyNby6eERs= |
| RSA-3072 | 5/7/8/10 | 128 | 388 | AwEAAd2UmZElsfz+6SYrfNhjd9PNIdXAerDJp0uSsjJIavVZt4O26PosRq3qvu1LQ9WNjfS17wvOeALD+i96LDqLPRSIxR7vq636gvreYenhmGxEb4qiTglnQk\
AlbvMwkyPKqdD5zyBcR/Er90Sfy+1lKtsUIQydDJcsjp6jHf6e31hsLhmDspjnAQKPdL+BWItnNE/oGAJeJI2F2uulC1NYIMl8+/sV5ERMzuqpxnixSMASQhGQlpZO7pJaCKi//ov1zzWSaDkQa/OdIirOQl06fgrMuxUdVe+W1dc17r\
oCLqVivmB7McvTeXVVEynsJeGoCFzeAVO0uCot3WTXOWKpNLOvsdpoun15Q+w5ZWei6+JT5P+iJ8UMcYJeh8QwXKk+wBurjZgEurkP9oRNXJfoi1UUIlDH6fCsaCE7k7Cb/NjMr6nmhZgIHpnFACuOEO6p36ws5BoV+AVACmyiPDpWI2\
5tHjnSLhGXVpJyoQjOvQujivU8IDn7rumvk4nn7C5k3Q== |
| ECDSA P-256 | 13 | 128 | 64 | OzyAWTHir/UqW2Zj1OvzCwkIBJ4eFPIB4GEXp6CkNC3QnNDapAVlaZc2rPz+AgdJf9jUlxr0v1Yeu/wJJKiQTA== |
| ECDSA P-384 | 14 | 192 | 96 | mfdcZ1hUF8YW8qFqfJs498QeZ2eS30h2od0q7DVH/HLHTqwOfliC1qnem3zCt0XeNrgS/kTt8lp/eRzu+/Y+Zy7dKP+TupWq72QkWZSGNVtryCiyYRD\
5jrO1oH+wt1Ao |
| Ed25519 | 15 | 128 | 32 | gUWHhcx2ABPH7JMWvf5OX0BFIC8NKrZ73v6lP8TBrJ4= |
| Ed448 | 16 | 224 | 56 | tpzCLdoTDnPXN091n2UfPvF9b0YcfIOZ2VkIpkPNcL70h7gznRXtEvBI+LZxxpxdGkaPTB/508UA |
Here is a list of current DNSSEC algorithms that your resolver supports, courtesy of rootcanary.org.
5: RSA-SHA1 | 7: RSA-SHA1-NSEC3 | 8: RSA-SHA256 | 10: RSA-SHA512 | 13: ECDSA P-256 | 14: ECDSA P-384 | 15: Ed25519 | 16: Ed448 | |
| SHA-1 | | | | | | | | |
| SHA-256 | | | | | | | | |
| SHA-384 | | | | | | | | |
 |
DNSSEC validation succeeded for this DS and signing algorithm combination |
 |
This DS and signing algorithm combination are not validated by your resolver(s) |
 |
This DS and signing algorithm lead to a SERVFAIL |
The DNSThough project by NLnet Labs measures worldwide DNSSEC algorithm support and publishes updated statistics at regular intervals.
Here is a collection of tools to verify that DNSSEC has been correctly configured for a particular zone:
Below are a few links for further reading: