%% You should probably cite rfc8976 instead of this I-D. @techreport{ietf-dnsop-dns-zone-digest-03, number = {draft-ietf-dnsop-dns-zone-digest-03}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-dnsop-dns-zone-digest/03/}, author = {Duane Wessels and Piet Barber and Matt Weinberg and Warren "Ace" Kumari and Wes Hardaker}, title = {{Message Digest for DNS Zones}}, pagetotal = 29, year = 2019, month = dec, day = 3, abstract = {This document describes a protocol and new DNS Resource Record that can be used to provide a cryptographic message digest over DNS zone data. The ZONEMD Resource Record conveys the digest data in the zone itself. When a zone publisher includes an ZONEMD record, recipients can verify the zone contents for accuracy and completeness. This provides assurance that received zone data matches published data, regardless of how the zone data has been transmitted and received. ZONEMD is not designed to replace DNSSEC. Whereas DNSSEC protects individual RRSets (DNS data with fine granularity), ZONEMD protects protects a zone's data as a whole, whether consumed by authoritative name servers, recursive name servers, or any other applications. As specified at this time, ZONEMD is not designed for use in large, dynamic zones due to the time and resources required for digest calculation. The ZONEMD record described in this document includes a field intended to enable future work to support large, dynamic zones.}, }