Comment by Stitch4223

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3]

Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.

Verisign does check for key validity but not for key strength / length as seen in your link.

[1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176