Modulelessen (3/3)
ZONEMD e integrità della zona
ZONEMD and zone integrity
A zone may be transferred or copied between systems. How can an operator check whether two copies contain the same data? ZONEMD publishes a digest computed over the zone’s records. When protected by a valid DNSSEC signature, the digest itself can be authenticated and used to detect corruption or divergence.
The digest does not encrypt the zone or repair an inconsistent copy. The generator and validator must follow the same specification, include the right records, and coordinate with the SOA serial and signatures.
Think of a digest as a document’s fingerprint. If two copies have different fingerprints, at least one differs. To know which copy is authoritative, you still need a trusted source and a verification process. ZONEMD is useful where validating distributed copies is a real operational need, not necessarily for every small zone.
Reference: RFC 8976 — Message Digest for DNS Zones
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What does a valid, authenticated ZONEMD digest show?