Internet.nl

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.n

It falls into the category that most people think they understand DNS, the same as JavaScript, or e.g. elections, but the devil is in the detail. And I can tell you, at least for DNS (and Dutch Elections), it's kind of tricky, see fun cases like https://github.com/internetstandards/Internet.nl/issues/1370 and I thought the same before I had my current job which involves quite some tricky DNS stuff (and regarding this we also sometimes encounter bugs in unbound https://github.com/internetstandards/Internet.nl/issues/1803 ) But maybe DNSSEC is the 'unnecessary complexity' for you (I think it's kind of fundamental to secure DNS). Also without DNSSEC they needed RFC's like https://datatracker.ietf.org/doc/html/rfc8020 to clarify fundamentals (same goes for https://datatracker.ietf.org/doc/html/rfc8482 to fix stuff).

GitHub, https://github.com/internetstandards/Internet.nl

For the past months we've been working on making our open source tool Internet.nl easier to deploy and develop on. Last week we release version 1.8.0 (https://en.internet.nl/article/release-1.8/) which includes these changes. Tests include: IPv6, DNSSEC, HTTPS/TLS, various security options like XSS, CSP headers, security.txt, RPKI, DMARC, DKIM, SPF, STARTTLS, DANE for web/email, and a browser connection test for IPv6 and DNSSEC. (see: https://en.internet.nl/faqs/) Using Docker & Docker Compose it is now trivial to deploy your own instance of our test tool, including all dependencies required to run the tests, web frontend, metrics collection, integration test suite and more. There are two deployment variants, one (the default) for single scan deployments with a web frontend (like on https://en.internet.nl) and one for batch scan where sca

Source and documentation for getting started can be found here: https://github.com/internetstandards/Internet.nl/blob/main/d...