26 of 26 shown
DNSKEY and RRSIG algorithm numbers with the RFC 9904 guidance for signing and validation.
| Value | Mnemonic | Description | References |
|---|---|---|---|
0 | DELETE | DELETE (DNSSEC algorithm 0): Delete DS. Signing zones: no guidance; validating: no guidance. | RFC 4034RFC 4398RFC 8078 |
1 | RSAMD5 | RSAMD5 (DNSSEC algorithm 1): RSA/MD5 (DEPRECATED, see 5). Signing zones: MUST NOT; validating: MUST NOT. | RFC 3110RFC 4034 |
2 | DH | DH (DNSSEC algorithm 2): Diffie-Hellman. Signing zones: no guidance; validating: no guidance. | RFC 2539 |
3 | DSA | DSA (DNSSEC algorithm 3): DSA/SHA1. Signing zones: MUST NOT; validating: MUST NOT. | RFC 3755RFC 2536Federal Information Processing Standards Publication (FIPS PUB) 186, Digital Signature Standard, 18 May 1994Federal Information Processing Standards Publication (FIPS PUB) 180-1, Secure Hash Standard, 17 April 1995. (Supersedes FIPS PUB 180 dated 11 May 1993.) |
5Note | RSASHA1 | RSASHA1 (DNSSEC algorithm 5): RSA/SHA-1. Signing zones: MUST NOT; validating: RECOMMENDED. | RFC 3110RFC 4034RFC 9905 |
6 | DSA-NSEC3-SHA1 | DSA-NSEC3-SHA1 (DNSSEC algorithm 6): DSA-NSEC3-SHA1. Signing zones: MUST NOT; validating: MUST NOT. | RFC 5155 |
7 | RSASHA1-NSEC3-SHA1 | RSASHA1-NSEC3-SHA1 (DNSSEC algorithm 7): RSASHA1-NSEC3-SHA1. Signing zones: MUST NOT; validating: RECOMMENDED. | RFC 5155RFC 9905 |
8Note | RSASHA256 | RSASHA256 (DNSSEC algorithm 8): RSA/SHA-256. Signing zones: RECOMMENDED; validating: RECOMMENDED. | RFC 5702 |
10 | RSASHA512 | RSASHA512 (DNSSEC algorithm 10): RSA/SHA-512. Signing zones: NOT RECOMMENDED; validating: RECOMMENDED. | RFC 5702 |
12 | ECC-GOST | ECC-GOST (DNSSEC algorithm 12): GOST R 34.10-2001 (DEPRECATED). Signing zones: MUST NOT; validating: MUST NOT. | RFC 5933Change the status of GOST Signature Algorithms in DNSSEC in the IETF stream to HistoricRFC 9906 |
13Note | ECDSAP256SHA256 | ECDSAP256SHA256 (DNSSEC algorithm 13): ECDSA Curve P-256 with SHA-256. Signing zones: RECOMMENDED; validating: RECOMMENDED. | RFC 6605 |
14 | ECDSAP384SHA384 | ECDSAP384SHA384 (DNSSEC algorithm 14): ECDSA Curve P-384 with SHA-384. Signing zones: MAY; validating: RECOMMENDED. | RFC 6605 |
15Note | ED25519 | ED25519 (DNSSEC algorithm 15): Ed25519. Signing zones: RECOMMENDED; validating: RECOMMENDED. | RFC 8080 |
16 | ED448 | ED448 (DNSSEC algorithm 16): Ed448. Signing zones: MAY; validating: RECOMMENDED. | RFC 8080 |
17 | SM2SM3 | SM2SM3 (DNSSEC algorithm 17): SM2 signing algorithm with SM3 hashing algorithm. Signing zones: MAY; validating: MAY. | RFC 9563 |
18 | MLDSA44 | MLDSA44 (DNSSEC algorithm 18): ML-DSA-44. Signing zones: MAY; validating: MAY. | draft-westerbaan-dnssec-mldsa-03 |
23 | ECC-GOST12 | ECC-GOST12 (DNSSEC algorithm 23): GOST R 34.10-2012. Signing zones: MAY; validating: MAY. | RFC 9558 |
252 | INDIRECT | INDIRECT (DNSSEC algorithm 252): Reserved for Indirect Keys. Signing zones: no guidance; validating: no guidance. | RFC 4034 |
253 | PRIVATEDNS | PRIVATEDNS (DNSSEC algorithm 253): private algorithm. Signing zones: MAY; validating: MAY. | RFC 4034 |
254 | PRIVATEOID | PRIVATEOID (DNSSEC algorithm 254): private algorithm OID. Signing zones: MAY; validating: MAY. | RFC 4034 |
| Range | Status | Description |
|---|---|---|
| 4 | reserved | Reserved |
| 9 | reserved | Reserved |
| 11 | reserved | Reserved |
| 19–22 | unassigned | Unassigned |
| 24–122 | unassigned | Unassigned |
| 123–251 | reserved | Reserved |
| 255 | reserved | Reserved |
Source: DNSSEC algorithm numbers and DS digest types (IANA), retrieved 2026-10-20. Data license: CC0-1.0. DNS Security Algorithm Numbers
DNSSEC algorithm 5, RSA with SHA-1: MUST NOT for signing, but still validated.
The registry guidance marks RSA/SHA-1 MUST NOT for signing because of SHA-1's weaknesses, while validators keep accepting it so that the remaining signed zones do not fail. Zones still on algorithm 5 or 7 should roll over to 13 or 15.
DNSSEC algorithm 8, RSA with SHA-256, still the most widely deployed DNSSEC algorithm.
Many top-level domains and the root zone sign with algorithm 8. Validators MUST support it; for new zones the registry recommends algorithm 13 (or 15), whose much smaller signatures keep responses small.
DNSSEC algorithm 13, ECDSA on P-256: the algorithm recommended for signing zones.
Algorithm 13 (RFC 6605) produces 64-byte signatures and 64-byte keys, far smaller than RSA, which keeps DNSSEC responses below fragmentation limits. The IANA registry marks it RECOMMENDED for signing and MUST for validation (RFC 9904 moved this guidance into the registry).
DNSSEC algorithm 15, Ed25519 (RFC 8080), recommended for both signing and validation.
Ed25519 signatures are deterministic, so no per-signature randomness is needed. Validator support has grown slowly, which is why algorithm 13 remains the more common choice for new zones.
Digest algorithms for DS records with the guidance for delegation and validation.
| Value | Hash | Description | References |
|---|---|---|---|
1 | SHA-1 | DS digest type 1 uses SHA-1. Delegation: MUST NOT; validation: RECOMMENDED. | RFC 3658RFC 9905 |
2 | SHA-256 | DS digest type 2 uses SHA-256. Delegation: RECOMMENDED; validation: RECOMMENDED. | RFC 4509 |
3 | GOST R 34.11-94 | DS digest type 3 uses GOST R 34.11-94. Delegation: MUST NOT; validation: MUST NOT. | RFC 5933Change the status of GOST Signature Algorithms in DNSSEC in the IETF stream to HistoricRFC 9906 |
4 | SHA-384 | DS digest type 4 uses SHA-384. Delegation: MAY; validation: RECOMMENDED. | RFC 6605 |
5 | Streebog-256 | DS digest type 5 uses Streebog-256. Delegation: MAY; validation: MAY. | RFC 9558 |
6 | SM3 | DS digest type 6 uses SM3. Delegation: MAY; validation: MAY. | RFC 9563 |
| Range | Status | Description |
|---|---|---|
| 0 | reserved | Reserved |
| 7–127 | unassigned | Unassigned |
| 128–252 | reserved | Reserved |
| 253–254 | private | Reserved for Private Use |
| 255 | unassigned | Unassigned |
Source: DNSSEC algorithm numbers and DS digest types (IANA), retrieved 2026-10-20. Data license: CC0-1.0. Digest Algorithms (DS RR Type Digest Algorithms)