1.1.1.1 - RFC 8509 root key trust anchor sentinel support

<p>1.1.1.1 now supports <a href="https://datatracker.ietf.org/doc/html/rfc8509" target="_blank" rel="noopener">RFC 8509<span class="external-link"> ↗︎</span></a> root key trust anchor sentinels. They let you check whether the responding resolver trusts a DNSSEC root key ahead of a key rollover.</p> <p>To check for KSK-2024 (key tag 38696), query DNSSEC-signed names in <code>dnstest.dev</code>:</p> <figure class="nb-code-figure" data-nb-lang="sh"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="sh" data-nb-lang="sh"><code><span class="line"><span class="nb-shiki-21nrsd"># On a sentinel-aware resolver that trusts KSK-2024:</span></span> <span class="line"></span> <span class="line"><span class="nb-shiki-21nrsd"># Returns NOERROR with an A answer.</span></span> <span class="line"><span class="nb-shiki-1t8gfj">dig</span><span class="nb-shiki-mdbnqw"> @1.1.1.1</span><span class="nb-shiki-mdbnqw"> root-key-sentinel-is-ta-38696.dnstest.dev.</span><span class="nb-shiki-mdbnqw"> A</span><span class="nb-shiki-mdbnqw"> +noall</span><span class="nb-shiki-mdbnqw"> +comments</span><span class="nb-shiki-mdbnqw"> +answer</span></span> <span class="line"></span> <span class="line"><span class="nb-shiki-21nrsd"># Returns SERVFAIL without an answer.</span></span> <span class="line"><span class="nb-shiki-1t8gfj">dig</span><span class="nb-shiki-mdbnqw"> @1.1.1.1</span><span class="nb-shiki-mdbnqw"> root-key-sentinel-not-ta-38696.dnstest.dev.</span><span class="nb-shiki-mdbnqw"> A</span><span class="nb-shiki-mdbnqw"> +noall</span><span class="nb-shiki-mdbnqw"> +comments</span><span class="nb-shiki-mdbnqw"> +answer</span></span> <span class="line"></span> <span class="line"><span class="nb-shiki-21nrsd"># CD bypasses sentinel processing and returns the original A answer.</span></span> <span class="line"><span class="nb-shiki-1t8gfj">dig</span><span class="nb-shiki-mdbnqw"> @1.1.1.1</span><span class="nb-shiki-mdbnqw"> root-key-sentinel-not-ta-38696.dnstest.dev.</span><span class="nb-shiki-mdbnqw"> A</span><span class="nb-shiki-mdbnqw"> +cdflag</span><span class="nb-shiki-mdbnqw"> +noall</span><span class="nb-shiki-mdbnqw"> +comments</span><span class="nb-shiki-mdbnqw"> +answer</span></span></code></pre></figure> <p>For background on DNSSEC validation, refer to <a href="https://developers.cloudflare.com/1.1.1.1/encryption/dnskey/">DNSKEY</a>.</p>