Network Working Group J.G. Gould Internet-Draft S.G. Gould Intended status: Standards Track T.S. Sutan-Tanon Expires: 20 January 2027 VeriSign, Inc. 19 July 2026 Registration Data Access Protocol (RDAP) Extension for Server Validation draft-gould-regext-rdap-server-validation-00 Abstract This document describes an Registration Data Access Protocol (RDAP) extension for providing the status of server validations. Server validations can be done for an extensible set of types, with examples including validating DNS resolution with the type "dns" and validating DNSSEC with the type "dnssec". The validations can be performed synchronously in the provisioning command or asynchronously based on a triggering command or a schedule. The extension will provide the status of the validations, by type, performed by the server in an RDAP lookup response. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 20 January 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights Gould, et al. Expires 20 January 2027 [Page 1] Internet-Draft RDAP server validation Extension July 2026 and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions Used in This Document . . . . . . . . . . . . . . 2 3. RDAP Conformance . . . . . . . . . . . . . . . . . . . . . . 3 4. "serverValidation_data" Member . . . . . . . . . . . . . . . 3 5. Extension Version Identifier . . . . . . . . . . . . . . . . 8 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 6.1. RDAP Extensions Registry . . . . . . . . . . . . . . . . 8 7. Security Considerations . . . . . . . . . . . . . . . . . . . 8 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 8.1. Normative References . . . . . . . . . . . . . . . . . . 8 8.2. Informative References . . . . . . . . . . . . . . . . . 9 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 1. Introduction This document describes an Registration Data Access Protocol (RDAP) extension for including server validation information for RDAP object classes, such as the Domain Object Class and the Nameserver Object Class in [RFC9083]. Server validations can be done for an extensible set of types, with examples including validating DNS resolution with the type "dns" and validating DNSSEC with the type "dnssec". The validations can be performed synchronously in the provisioning command or asynchronously based on a triggering command or a schedule. The server validation information is returned in an RDAP lookup response that includes for each validation type the current validation status and the date and time of the last validation. This document is complementary to the Server Validation Extension for the Extensible Provisioning Protocol (EPP) [I-D.gould-regext-epp- server-validation], but registry operators do not need to implement that extension in their EPP server in order to implement this RDAP extension. 2. Conventions Used in This Document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. Gould, et al. Expires 20 January 2027 [Page 2] Internet-Draft RDAP server validation Extension July 2026 The example RDAP responses don't include all of the RDAP response members, but are only representative of the members that are relavant to this extension. 3. RDAP Conformance Servers implementing this extension MUST include the string "serverValidation" in the "rdapConformance" ([RFC9083]) array of all relevant RDAP responses. The registration of the "serverValidation" extension identifier is described in Section 6. 4. "serverValidation_data" Member The server validation information is conveyed via a new top-level object member named "serverValidation_data" within the object class that the server validations have been executed for. The "serverValidation_data" member includes a list of server validation objects, where there is up to one per type, containing the following members: * type -- a REQUIRED type of server validation that is up to server policy. Example values include "dns" for validation of DNS resolution and "dnssec" for validation of DNSSEC. * status -- a REQUIRED status of the server validation with the values of "success" to reflect that the last validation was successful and "failed" to reflect that the last validation failed. * date -- An OPTIONAL date and time when the server validation was last executed. * operation -- An OPTIONAL operation that triggered the validation. This element is not included if the server validation was performed asynchronously without a triggering transform operation. The possible enumerated list of operation values are: - create -- Create operation as defined in [RFC5730]. - delete -- Delete operation as defined in [RFC5730] if the delete operation does not result in an immediate purge of the object. - renew -- Renew operation as defined in [RFC5730]. Gould, et al. Expires 20 January 2027 [Page 3] Internet-Draft RDAP server validation Extension July 2026 - transfer -- Transfer operation as defined in [RFC5730] that MUST set the "op" member with one of the possible transfer type values that include "request", "approve", "cancel", or "reject". - update -- Update operation as defined in [RFC5730]. - restore -- Restore operation as defined in [RFC3915] that MUST set the "op" member with one of the possible restore type values that include "request" or "report". - autoRenew -- Auto renew operation executed by the server. - autoDelete -- Auto delete operation executed by the server if the auto delete operation does not result in an immediate purge of the object. - custom -- Custom operation that MUST set the "op" attribute with the custom operation name. The custom operations supported is up to server policy. * op -- An OPTIONAL custom operation name or sub-operation of the "operation" member. * lastSuccess -- An OPTIONAL date and time when the server validation was last successful. This member should only be returned when the "status" member has the value of "failed" and there was a prior successful validation. * firstFailed -- An OPTIONAL date and time when the server validation first failed. This element should only be returned when the "status" member has the value of "failed". * lastFailed -- An OPTIONAL date and time when the server validation last failed. This member should only be returned when the "status" member has the value of "success" and there was a prior failed validation. * reason -- An OPTIONAL array of server validation failure reasons when the "status" member has the value of "failed". If present, this element contains the server-specific text to help explain the reason for the failure. * reasonLang -- An OPTIONAL langauge of the "reason" member text with a default value of "en" (English). Gould, et al. Expires 20 January 2027 [Page 4] Internet-Draft RDAP server validation Extension July 2026 { "objectClassName": "domain", "handle": "XXX", "ldhName": "example.com", "rdapConformance": ["rdap_level_0", "serverValidation"], "serverValidation_data": [ { "type": "dnssec", "status": "success", "date": "2026-01-01T12:22:53.0Z" } ] } Figure 1: Domain object including the "serverValidation_data" member for the successful "dnssec" server validation: { "objectClassName": "domain", "handle": "XXX", "ldhName": "example.com", "rdapConformance": ["rdap_level_0", "serverValidation"], "serverValidation_data": [ { "type": "dnssec", "status": "failed", "date": "2026-01-03T07:21:33Z", "lastSuccess": "2025-12-11T07:20:00Z", "firstFailed": "2025-12-12T08:19:44Z", "reason": [ "Matching DNSKEY not found for DS keyTag 12345" ] } ] } Figure 2: Domain object including the "serverValidation_data" member for the failed "dnssec" server validation: Gould, et al. Expires 20 January 2027 [Page 5] Internet-Draft RDAP server validation Extension July 2026 { "objectClassName": "domain", "handle": "XXX", "ldhName": "example.com", "rdapConformance": ["rdap_level_0", "serverValidation"], "serverValidation_data": [ { "type": "dns", "status": "success", "date": "2026-01-01T12:22:53.0Z", "operation": "create" }, { "type": "dnssec", "status": "success", "date": "2026-01-01T12:22:53.0Z", "operation": "create", "firstFailed": "2026-01-01T06:22:53.0Z" } ] } Figure 3: Domain object including the "serverValidation_data" member for the successful "dns" and "dnssec" server validation: Gould, et al. Expires 20 January 2027 [Page 6] Internet-Draft RDAP server validation Extension July 2026 { "objectClassName": "domain", "handle": "XXX", "ldhName": "example.com", "rdapConformance": ["rdap_level_0", "serverValidation"], "serverValidation_data": [ { "type": "dns", "status": "success", "date": "2026-01-01T12:22:53.0Z", "operation": "create" }, { "type": "dnssec", "status": "failed", "date": "2026-01-01T12:22:53Z", "firstFailed": "2026-01-01T12:22:53Z", "operation": "create", "reason": [ "Matching DNSKEY not found for DS keyTag 12345", "Insecure DNSKEY algorithm for DS keyTag 54321" ] } ] } Figure 4: Domain object including the "serverValidation_data" member for the successful "dns" server validation and a failed "dnssec" server validation: { "objectClassName": "domain", "handle": "XXX", "ldhName": "example.com", "rdapConformance": ["rdap_level_0", "serverValidation"], "serverValidation_data": [ { "type": "dnssec", "status": "success", "date": "2026-01-01T12:22:53.0Z", "operation": "custom", "op": "keyExchange" } ] } Gould, et al. Expires 20 January 2027 [Page 7] Internet-Draft RDAP server validation Extension July 2026 Figure 5: Domain object including the "serverValidation_data" member for the successful "dnssec" server validation triggered by the custom "keyExchange" operation: 5. Extension Version Identifier This extension supports the Point Versioning defined in [I-D.ietf-regext-rdap-versioning] with a Point Extension Version Identifier of "serverValidation-0.1". When there are interface changes to the extension, the Point Extension Version Identifier will be incremented, which may not match the draft version number. When the draft becomes a working group document and passes Working Group Last Call (WGLC), the Point Extension Version Identifier will be changed to "serverValidation-1.0". 6. IANA Considerations 6.1. RDAP Extensions Registry IANA is requested to register the following value in the RDAP Extensions Registry: Extension identifier: serverValidation Registry operator: Any Published specification: This document. Contact: IETF Intended usage: This extension identifies RDAP extension for server validation information. 7. Security Considerations The extension described in this document does not provide any security services beyond those described by [RFC9083]. 8. References 8.1. Normative References [I-D.ietf-regext-rdap-versioning] Gould, J., Keathley, D., and M. Loffredo, "Versioning in the Registration Data Access Protocol (RDAP)", Work in Progress, Internet-Draft, draft-ietf-regext-rdap- versioning-05, 21 April 2026, . Gould, et al. Expires 20 January 2027 [Page 8] Internet-Draft RDAP server validation Extension July 2026 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC9083] Hollenbeck, S. and A. Newton, "JSON Responses for the Registration Data Access Protocol (RDAP)", STD 95, RFC 9083, DOI 10.17487/RFC9083, June 2021, . 8.2. Informative References [RFC3915] Hollenbeck, S., "Domain Registry Grace Period Mapping for the Extensible Provisioning Protocol (EPP)", RFC 3915, DOI 10.17487/RFC3915, October 2004, . [RFC5730] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009, . Authors' Addresses James Gould VeriSign, Inc. 12061 Bluemont Way Reston, VA 20190 United States of America Email: jgould@verisign.com URI: http://www.verisign.com Sandra Gould VeriSign, Inc. 12061 Bluemont Way Reston, VA 20190 United States of America Email: sgould@verisign.com URI: http://www.verisign.com Gould, et al. Expires 20 January 2027 [Page 9] Internet-Draft RDAP server validation Extension July 2026 Tanya Sutan-Tanon VeriSign, Inc. 12061 Bluemont Way Reston, VA 20190 United States of America Email: thasutantanon@verisign.com URI: http://www.verisign.com Gould, et al. Expires 20 January 2027 [Page 10]