@techreport{berra-dnsop-keystate-03, number = {draft-berra-dnsop-keystate-03}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-berra-dnsop-keystate/03/}, author = {Erik Bergström and Leon Fernandez and Johan Stenstam}, title = {{Signaling Key State Via a DNS EDNS(0) Option}}, pagetotal = 14, year = 2026, month = jun, day = 17, abstract = {This document introduces the KeyState EDNS(0) option, to enable a child operator to query a parent UPDATE Receiver about the state of a SIG(0) key used to secure cross-zone-cut DNS UPDATE messages. The KeyState option allows the child to include a key state inquiry in its DNS query, and the parent to include the corresponding key state in its response. This addresses the challenge of maintaining synchronization of SIG(0) keys between the child and the parent UPDATE Receiver: the child can become aware of any issue with its SIG(0) key in advance, before attempting the next operational DNS UPDATE. TO BE REMOVED: This document is being collaborated on in Github at: https://github.com/johanix/draft-berra-dnsop-keystate (https://github.com/johanix/draft-berra-dnsop-keystate). The most recent working version of the document, open issues, etc, should all be available there. The authors (gratefully) accept pull requests.}, }