Add comprehensive DNSSEC documentation improvements #27630
+144
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Based on internal engineering discussions, add detailed explanations and best practices for DNSSEC features: 1. Create DNSSEC FAQ page with: - CDS/CDNSKEY records explanation and purpose - How Cloudflare automates DS record management (RFC 8078) - Key rotation frequency and automation - Migration scenarios and limitations - Why existing DS records can't be reused (chain of trust) - EDNS0 support confirmation 2. Enhance multi-signer DNSSEC technical details: - What happens when dnssec_multi_signer is enabled - How Cloudflare signs external ZSKs with its KSK - CDS/CDNSKEY generation for multi-signer setups 3. Add multi-signer best practices: - Model 2 recommendation - DNSKEY flag reference (256 for ZSK, 257 for KSK) - Critical TTL adherence requirements - Provider compatibility verification - Testing recommendations Addresses SPM-3058
Link 'via API' text to the Edit DNSSEC Status API endpoint for easier navigation to the API documentation.
Remove specific vendor reference to keep documentation more general.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Based on internal engineering discussions, add detailed explanations and best practices for DNSSEC features:
Create DNSSEC FAQ page with:
Enhance multi-signer DNSSEC technical details:
Add multi-signer best practices:
Addresses SPM-3058