From: Bob Halley <halley@dnspython.org>
Date: Sat, 25 Jul 2026 16:12:26 +0000 (-0700)
Subject: RFC 9904 + IANA registries replace RFC 8624 for DNSSEC algorithm guidance.
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=af21b39addc69ff9b414d3d61f347af13682fdd0;p=thirdparty%2Fdnspython.git

RFC 9904 + IANA registries replace RFC 8624 for DNSSEC algorithm guidance.
---

diff --git a/dns/dnssec.py b/dns/dnssec.py
index 2738e3da..a6949c02 100644
--- a/dns/dnssec.py
+++ b/dns/dnssec.py
@@ -162,10 +162,12 @@ rfc_8624_policy = SimpleDeny(
     {DSDigest.NULL},
 )
 
+rfc_9904_policy = rfc_8624_policy
+
 allow_all_policy = SimpleDeny(set(), set(), set(), set())
 
 
-default_policy = rfc_8624_policy
+default_policy = rfc_9904_policy
 
 
 def make_ds(
@@ -190,7 +192,7 @@ def make_ds(
         using this origin.
     :type origin: :py:class:`dns.name.Name` or ``None``
     :param policy: The policy to use. If ``None``, ``dns.dnssec.default_policy``
-        is used (defaults to RFC 8624 policy).
+        is used (defaults to RFC 9904 policy).
     :type policy: :py:class:`dns.dnssec.Policy` or ``None``
     :param validating: If ``True``, policy is checked in validating mode ("Is it
         ok to validate using this digest algorithm?"). Otherwise checked in
@@ -339,7 +341,7 @@ def _validate_rrsig(
         the actual current time is used.
     :type now: float or ``None``
     :param policy: The policy to use. If ``None``, ``dns.dnssec.default_policy``
-        is used (defaults to RFC 8624 policy).
+        is used (defaults to RFC 9904 policy).
     :type policy: :py:class:`dns.dnssec.Policy` or ``None``
     :raises ValidationFailure: If the signature is expired, not yet valid, the
         public key is invalid, the algorithm is unknown, verification fails, etc.
@@ -400,7 +402,7 @@ def _validate(
         the actual current time is used.
     :type now: int or ``None``
     :param policy: The policy to use. If ``None``, ``dns.dnssec.default_policy``
-        is used (defaults to RFC 8624 policy).
+        is used (defaults to RFC 9904 policy).
     :type policy: :py:class:`dns.dnssec.Policy` or ``None``
     :raises ValidationFailure: If the signature is expired, not yet valid, the
         public key is invalid, the algorithm is unknown, verification fails, etc.
@@ -477,7 +479,7 @@ def _sign(
         Default is ``False``.
     :type verify: bool
     :param policy: The policy to use. If ``None``, ``dns.dnssec.default_policy``
-        is used (defaults to RFC 8624 policy).
+        is used (defaults to RFC 9904 policy).
     :type policy: :py:class:`dns.dnssec.Policy` or ``None``
     :param origin: If ``None`` (the default), all names must be absolute.
         Otherwise, this origin is used to make names absolute when signing.
diff --git a/doc/rfc.rst b/doc/rfc.rst
index 24692786..51e151e3 100644
--- a/doc/rfc.rst
+++ b/doc/rfc.rst
@@ -114,15 +114,15 @@ DNSSEC RFCs
 `RFC 8080 <https://tools.ietf.org/html/rfc8080>`_
     Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
 
-`RFC 8624 <https://tools.ietf.org/html/rfc8624>`_
-    Algorithm Implementation Requirements and Usage Guidance for DNSSEC.
-
 `RFC 9157 <https://tools.ietf.org/html/rfc9157>`_
     Revised IANA Considerations for DNSSEC.
 
 `RFC 9824 <https://tools.ietf.org/html/rfc9824>`_
     Compact Denial of Existence in DNSSEC
 
+`RFC 9904 <https://www.rfc-editor.org/info/rfc9904>`_
+    DNSSEC Cryptographic Algorithm Recommendation Update Process
+
 Misc RFCs
 ---------