The zone uses a DNSSEC algorithm that should no longer be used.

DNSSEC_DEPRECATED_ALGORITHM · Severity: Warning

• WarningDNSSEC_DEPRECATED_ALGORITHM

  The zone uses a DNSSEC algorithm that should no longer be used.

  The IANA algorithm registry (RFC 9904) says RSAMD5 and DSA must not be used for signing, and RFC 9905 says the same of the SHA-1 based algorithms (RSASHA1, RSASHA1-NSEC3-SHA1). Validators are dropping support for them, and a zone signed only with them may be treated as unsigned.

  Recommendation: Roll the zone to a current algorithm such as ECDSAP256SHA256 (13) or RSASHA256 (8).

Reported by

• DNSSEC check
• Domain health check

Available through the API

• DNSSEC check API
• Domain health check API

Related findings

• Error DNSSEC_DS_WITHOUT_DNSKEY A DS record has no DNSKEY with the same algorithm.
• Error DNSSEC_BOGUS DNSSEC validation fails for the domain.
• Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
• Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.
• Warning DNSSEC_SHA1_DIGEST A DS record uses a SHA-1 digest.

All findings