Registration Data Access Protocol (RDAP) Extension for Server ValidationVeriSign, Inc.12061 Bluemont WayRestonVA20190USjgould@verisign.comhttp://www.verisign.comVeriSign, Inc.12061 Bluemont WayRestonVA20190USsgould@verisign.comhttp://www.verisign.comVeriSign, Inc.12061 Bluemont WayRestonVA20190USthasutantanon@verisign.comhttp://www.verisign.com
General
RDAPRegistration Data Access ProtocolJSONValidationServerServer ValidationExtension
This document describes an Registration Data Access Protocol (RDAP)
extension for providing the status of server validations. Server
validations can be done for an extensible set of types, with examples
including validating DNS resolution with the type "dns" and
validating DNSSEC with the type "dnssec". The validations
can be performed synchronously in the provisioning command
or asynchronously based on a triggering command or a schedule.
The extension will provide the status of the validations, by type, performed
by the server in an RDAP lookup response.
Introduction
This document describes an Registration Data Access Protocol (RDAP) extension for
including server validation information for RDAP object classes, such as the Domain Object Class and the Nameserver Object Class
in . Server validations can be done for an extensible set of types, with examples
including validating DNS resolution with the type "dns" and
validating DNSSEC with the type "dnssec". The validations
can be performed synchronously in the provisioning command
or asynchronously based on a triggering command or a schedule.
The server validation information is returned in an RDAP lookup response that includes
for each validation type the current validation status and the date and time of the
last validation.
This document is complementary to the Server Validation Extension for the Extensible Provisioning Protocol (EPP) [I-D.gould-regext-epp-server-validation],
but registry operators do not need to implement that extension in their EPP server in order to implement this RDAP extension.
Conventions Used in This DocumentThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
"MAY", and "OPTIONAL" in this document are to be interpreted as
described in BCP 14
when, and only when, they
appear in all capitals, as shown here.The example RDAP responses don't include all of the RDAP response members, but are only representative of the
members that are relavant to this extension.RDAP ConformanceServers implementing this extension MUST include the string "serverValidation" in the "rdapConformance" () array of all relevant RDAP responses.
The registration of the "serverValidation" extension identifier is described in ."serverValidation_data" MemberThe server validation information is conveyed via a new top-level object member named "serverValidation_data" within the object class that the server validations have been executed for.
The "serverValidation_data" member includes a list of server validation objects, where there is up to one per type, containing the following members:
type -- a REQUIRED type of server validation that is up to server policy. Example values include "dns" for
validation of DNS resolution and "dnssec" for validation of DNSSEC.
status -- a REQUIRED status of the server validation with the values of "success" to reflect
that the last validation was successful and "failed" to reflect that the last validation failed.
date -- An OPTIONAL date and time when the server validation was last executed.
operation -- An OPTIONAL operation that triggered the validation. This element is not included if the server validation
was performed asynchronously without a triggering transform operation. The possible enumerated list of operation values are:
create -- Create operation as defined in .
delete -- Delete operation as defined in if the delete operation does not result in
an immediate purge of the object.
renew -- Renew operation as defined in .
transfer -- Transfer operation as defined in that MUST set the
"op" member with one of the possible transfer type values that include "request", "approve", "cancel", or "reject".
update -- Update operation as defined in .
restore -- Restore operation as defined in that MUST set the
"op" member with one of the possible restore type values that include "request" or "report".
autoRenew -- Auto renew operation executed by the server.
autoDelete -- Auto delete operation executed by the server if the auto delete operation does not result in an immediate
purge of the object.
custom -- Custom operation that MUST set the "op" attribute with the custom operation name.
The custom operations supported is up to server policy.
op -- An OPTIONAL custom operation name or sub-operation of the "operation" member.
lastSuccess -- An OPTIONAL date and time when the server validation was last successful. This
member should only be returned when the "status" member has the value of "failed" and there was a prior
successful validation.
firstFailed -- An OPTIONAL date and time when the server validation first failed. This
element should only be returned when the "status" member has the value of "failed".
lastFailed -- An OPTIONAL date and time when the server validation last failed. This
member should only be returned when the "status" member has the value of "success" and there was a prior
failed validation.
reason -- An OPTIONAL array of server validation failure reasons when the "status" member has the value of "failed".
If present, this element contains the server-specific text to help explain the reason for the failure.
reasonLang -- An OPTIONAL langauge of the "reason" member text with a default value of "en" (English).
Domain object including the "serverValidation_data" member for the successful "dnssec" server validation:
{
"objectClassName": "domain",
"handle": "XXX",
"ldhName": "example.com",
"rdapConformance": ["rdap_level_0", "serverValidation"],
"serverValidation_data": [
{
"type": "dnssec",
"status": "success",
"date": "2026-01-01T12:22:53.0Z"
}
]
}
Domain object including the "serverValidation_data" member for the failed "dnssec" server validation:
{
"objectClassName": "domain",
"handle": "XXX",
"ldhName": "example.com",
"rdapConformance": ["rdap_level_0", "serverValidation"],
"serverValidation_data": [
{
"type": "dnssec",
"status": "failed",
"date": "2026-01-03T07:21:33Z",
"lastSuccess": "2025-12-11T07:20:00Z",
"firstFailed": "2025-12-12T08:19:44Z",
"reason": [
"Matching DNSKEY not found for DS keyTag 12345"
]
}
]
}
Domain object including the "serverValidation_data" member for the successful "dns" and "dnssec" server validation:
{
"objectClassName": "domain",
"handle": "XXX",
"ldhName": "example.com",
"rdapConformance": ["rdap_level_0", "serverValidation"],
"serverValidation_data": [
{
"type": "dns",
"status": "success",
"date": "2026-01-01T12:22:53.0Z",
"operation": "create"
},
{
"type": "dnssec",
"status": "success",
"date": "2026-01-01T12:22:53.0Z",
"operation": "create",
"firstFailed": "2026-01-01T06:22:53.0Z"
}
]
}
Domain object including the "serverValidation_data" member for the successful "dns"
server validation and a failed "dnssec" server validation:
{
"objectClassName": "domain",
"handle": "XXX",
"ldhName": "example.com",
"rdapConformance": ["rdap_level_0", "serverValidation"],
"serverValidation_data": [
{
"type": "dns",
"status": "success",
"date": "2026-01-01T12:22:53.0Z",
"operation": "create"
},
{
"type": "dnssec",
"status": "failed",
"date": "2026-01-01T12:22:53Z",
"firstFailed": "2026-01-01T12:22:53Z",
"operation": "create",
"reason": [
"Matching DNSKEY not found for DS keyTag 12345",
"Insecure DNSKEY algorithm for DS keyTag 54321"
]
}
]
}
Domain object including the "serverValidation_data" member for the successful "dnssec"
server validation triggered by the custom "keyExchange" operation:
{
"objectClassName": "domain",
"handle": "XXX",
"ldhName": "example.com",
"rdapConformance": ["rdap_level_0", "serverValidation"],
"serverValidation_data": [
{
"type": "dnssec",
"status": "success",
"date": "2026-01-01T12:22:53.0Z",
"operation": "custom",
"op": "keyExchange"
}
]
}
This extension supports the Point Versioning defined in with
a Point Extension Version Identifier of "serverValidation-0.1".
When there are interface changes to the extension, the Point Extension Version Identifier will be incremented, which may not match the draft version number.
When the draft becomes a working group document and passes Working Group Last Call (WGLC), the Point Extension Version Identifier will be changed to "serverValidation-1.0".
IANA ConsiderationsRDAP Extensions RegistryIANA is requested to register the following value in the RDAP
Extensions Registry:
Extension identifier:
serverValidation
Registry operator:
Any
Published specification:
This document.
Contact:
IETF <iesg@ietf.org>
Intended usage:
This extension identifies RDAP extension for server validation information.
Security ConsiderationsThe extension described in this document does not provide any security services beyond those described by .ReferencesNormative ReferencesInformative References