Repository navigation
EppLib secDNS (DNSSEC) extension not handling all elements in RFC #31
Description
It is now only possible to add and remove the most basic secDNS (EPP DNSSEC) elements usting EppLib.
The following examples are from http://www.rfc-editor.org/rfc/rfc5910.txt
Example use of the secDNS-1.1 DS Data Interface for a create: (EppLib handles this)
<secDNS:dsData>
<secDNS:keyTag>12345</secDNS:keyTag>
<secDNS:alg>3</secDNS:alg>
<secDNS:digestType>1</secDNS:digestType>
<secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
</secDNS:dsData>
Example use of secDNS-1.1 DS Data Interface with option key data for a create: (Not handled in EppLib)
<secDNS:dsData>
<secDNS:keyTag>12345</secDNS:keyTag>
<secDNS:alg>3</secDNS:alg>
<secDNS:digestType>1</secDNS:digestType>
<secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
<secDNS:keyData>
<secDNS:flags>257</secDNS:flags>
<secDNS:protocol>3</secDNS:protocol>
<secDNS:alg>1</secDNS:alg>
<secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
</secDNS:keyData>
</secDNS:dsData>
Example use of the secDNS-1.1 Key Data Interface for a create: (Not handled in EppLib)
<secDNS:keyData>
<secDNS:flags>257</secDNS:flags>
<secDNS:protocol>3</secDNS:protocol>
<secDNS:alg>1</secDNS:alg>
<secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
</secDNS:keyData>
An OPTIONAL secDNS:maxSigLife element is also not handled in EppLib:
<secDNS:maxSigLife>604800</secDNS:maxSigLife>
Activity
ademar commentedon Sep 25, 2026
Thanks for the detailed report, and sorry it took so long. This is fixed in EppLib 1.7.0 (#61), which covers everything you listed from RFC 5910:
SecDNSKeyData, either on its own (SecDNSCreate.KeyData,SecDNSUpdate.KeyDataToAdd/KeyDataToRemove) or inside a DS record (SecDNSData.KeyData).maxSigLifeon create, and changing it throughSecDNSUpdate.MaxSigLife.SecDNSUpdate.RemoveAllandUrgent.SecDNSInfData.FromResponse(response).It also fixes key tags above 32767 and lets you set
DigestType(for example SHA256). Note thatKeyTagis now anint, so rebuild after upgrading. The upgrading notes have the details.Complete the secDNS (DNSSEC) extension per RFC 5910