Editing DNSSEC (section)

== DS Data Interface ==

<pre>secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)</pre>
<pre>addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>
<pre>delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>

The order of these whitespace-separated parameters matches the DNS DS record type.


<pre>secDNS-ds keyTag = <INT></pre>

A parameter that contains a key tag value as described in Section 5.1.1 of RFC 4034.
The parameter is represented as an unsignedShort [W3C.REC-xmlschema-2-20010502].


<pre>secDNS-ds alg = <INT></pre>

A parameter that contains an algorithm value as described in Section 5.1.2 of RFC 4034.


<pre>secDNS-ds digestType = <INT></pre>

A parameter that contains a digest-type value as described in Section 5.1.3 of RFC 4034.<br/>
Available options are:<br/>
SHA-1 (SHA1) - Digest Type 1<br/>
SHA-256 (SHA256) - Digest Type 2<br/>
GOST R 34.11-94 (GOST) - Digest Type 3<br/>
SHA-384 (SHA384) - Digest Type 4

These digest types correspond to the digest algorithm used to generate the hash of the DNSKEY record, providing cryptographic integrity for DNSSEC. It's worth noting that the use of SHA-1 is now deprecated due to vulnerabilities, and SHA-256 is recommended for better security.


<pre>secDNS-ds digest = <TEXT></pre>

A parameter that contains a digest value as described in Section 5.1.4 of RFC 4034. 
The parameter is represented as a hexBinary [W3C.REC-xmlschema-2-20010502].