{ "ChangeLog" : { "2024-01-31" : [ "Added this ChangeLog.", "Add content of NS records to the list of names checked in [dns-zz-idna2008-compliance](#Test-Case-dns-zz-idna2008-compliance).", "Add [dnssec-93](#Test-Case-dnssec-93) test case.", "Remove the dnssec-12, dnssec-15, dnssec-16, dnssec-17 and dnssec-18 test cases.", "The [ZM_ALGORITHM_NOT_RECOMMENDED](#Error-ZM_ALGORITHM_NOT_RECOMMENDED) error raised by [dnssec-05](#Test-Case-dnssec-05) is now an **ERROR**.", "The maturity of all cases in the [EPP suite](#Test-Suite-StandardEPP) has been raised to **BETA**.", "Added additional error codes to [epp-16](#Test-Case-epp-16).", "Added check for `transferPeriod` RGP status to [epp-19](#Test-Case-epp-19).", "Add [epp-25](#Test-Case-epp-25) test case.", "Case maturity metrics: ALPHA 7% , BETA 74%, GAMMA 19%" ], "2024-02-07" : [ "Zonemaster cases are now generated directly from [Zonemaster::Engine](https://metacpan.org/dist/Zonemaster-Engine), so now include all possible error messages.", "Rather than placing \"common\" errors at the suite level, each case now lists all the errors it may emit. In the HTML output, the cases that may emit an error are listed for each error.", "Began providing descriptions of errors, and adjusting their severity levels accordingly.", "Protocol-related errors are now standardised, so for example, the SRSGW and IDN cases use the same errors as the EPP cases, for EPP-related errors.", "The way that the specification version is calculated has changed to accommodate the new release process (now that the repository has multiple branches, counting commits can result in two files having the same version).", "Case maturity metrics: ALPHA 5% (-2%), BETA 57% (-17%), GAMMA 38% (+19%)" ], "2024-02-14" : [ "Links to references and notes about upgraded message severities in Zonemaster cases have been fixed.", "The [epp.greeting](#Input-Parameter-epp.greeting) input parameter is now a file upload.", "Added schemas to all input parameters that didn't have them.", "Case maturity metrics: ALPHA 7% (+2%), BETA 43% (-14%), GAMMA 50% (+12%)" ], "2024-02-21" : [ "The [ZM_NAMESERVER_IP_PRIVATE_NETWORK](#Error-ZM_NAMESERVER_IP_PRIVATE_NETWORK) error now has `CRITICAL` severity.", "The suites that use an Input Parameter are now listed, in addition to any test cases.", "All cases in the [Minimum RPMs](#Test-Suite-MinimumRPMs) suite are now at BETA maturity, except for [minimumRPMs-03](#Test-Case-minimumRPMs-03), which may change due to anticipated changes to the Trademark Claims policy.", "All cases in the [DNSSEC Operations](#Test-Suite-DNSSECOperations) suite are now at BETA maturity.", "Clarified wording of the [DNSSEC Operations](#Test-Suite-DNSSECOperations) test cases and added configuration guidance for applicants.", "Any DNS query or XFR that fails during the [DNSSEC Operations](#Test-Suite-DNSSECOperations) suite is now an error.", "Added the [epp.tlsCertificateStore](#Resource-epp.tlsCertificateStore) resource to [rdap-91](#Test-Case-rdap-91).", "Added new test plans that will only be available in OT&E, to allow testing of specific test suites.", "Added the `OTE-Only` property to test plan objects indicating the above, and bumped the schema version accordingly.", "All error messages are now documented.", "Case maturity metrics: ALPHA <1% (-5%), BETA 50% (+7%), GAMMA 50% (+0%)" ], "2024-02-28" : [ "Added the [EPP_GREETING_MISSING_EN_LANG](#Error-EPP_GREETING_MISSING_EN_LANG) error to [epp-02](#Test-Case-epp-02). The circumstances under which the [EPP_GREETING_RECOMMENDED_EXTENSION_MISSING](#Error-EPP_GREETING_RECOMMENDED_EXTENSION_MISSING) warning will be produced have been clarified.", "Various changes to input parameter schema to address issues with OpenAPI code generators not being able to support various JSON Schema features.", "The [dnssecOps.primaryServer](#Input-Parameter-dnssecOps.primaryServers) input parameter has been changed to an array to allow for multiple servers to be specified.", "Documented the [test sequence](#Preamble-2.5.-Test-sequence).", "In order to simplify the specifications and avoid confusion, inter-case dependencies have been removed from the HTML representation.", "Added the [DNS_INCONSISTENT_RESPONSES](#Error-DNS_INCONSISTENT_RESPONSES) to all test cases in the [DNS](#Test-Suite-StandardDNS) and [DNSSEC](#Test-Suite-StandardDNSSEC) suites.", "Upgraded the [ZM_RNAME_MISUSED_AT_SIGN](#Error-ZM_RNAME_MISUSED_AT_SIGN) and [ZM_DIFFERENT_SOURCE_IP](#Error-ZM_DIFFERENT_SOURCE_IP) errors to `ERROR`.", "Case maturity metrics: ALPHA <1% (no change), BETA 50% (no change), GAMMA 50% (no change)" ], "2024-03-13" : [ "Added a number of new errors to [epp-07](#Test-Case-epp-07).", "In [rde-07](#Test-Case-rde-07), clarify that a domain with the `pendingDelete` status can have an `` element that is before the watermark.", "Case maturity metrics: ALPHA <1% (no change), BETA 50% (no change), GAMMA 50% (no change)" ], "2024-03-20" : [ "Clarified the elements that will be tested in [epp-07](#Test-Case-epp-07).", "Added `Configuration` section to the YAML file which holds internal test system configuration parameters.", "Case maturity metrics: ALPHA <1% (no change), BETA 50% (no change), GAMMA 50% (no change)" ], "2024-03-26" : [ "This is the final release of the test specifications before the start of the Public Comment. No changes to the specification will be published until after the Public Comment process has been completed.", "Since the [Registration Data Policy](https://www.icann.org/resources/pages/registration-data-policy-2024-02-21-en#trd-registrar-registry)\nallows for different registry data models to apply to different registrar accounts (depending on whether or not there is an appropriate\nlegal basis, and data processing agreement is in place), the `general.minimalPublicDataSet` input parameter has been replaced with\n[`general.registryDataModel`](#Input-Parameter-general.registryDataModel), which is an enum. To support this, the\n[`epp.clid01DataModel`](#Input-Parameter-epp.clid01DataModel) and [`epp.clid02DataModel`](#Input-Parameter-epp.clid02DataModel) input\nparameters have been added, so that different registry data models can be specified for each registrar account.\n", "The algorithm mnemonics that can be specified in the [`dnssecOps.tsigKey`](#Input-Parameter-dnssecOps.tsigKey) input parameter have been restricted to those that are (a) applicable for DNS and (b) secure.", "Error messages extracted from Zonemaster now include the tag descriptions from `Zonemaster::Engine`.", "In [minimumRPMs-03](#Test-Case-minimumRPMs-03), the maximum time period between when the trademark claim notice acknowledgement and the submission of the domain `` command has been increased from 48 hours to one year. The maturity of this test has been changed to BETA.", "Case maturity metrics: ALPHA 0% (-1%), BETA 0% (-50%), GAMMA 100% (+50%)." ], "2024-06-05" : [ "This is the first release since the end of the [Public Comment](https://www.icann.org/en/public-comment/proceeding/review-of-the-registry-system-testing-20-test-specifications-and-api-26-03-2024) proceeding.", "The specification has been updated to include *data providers* which are associated with test cases.", "Clarified that the [epp-05](#Test-Case-epp-05) test case will be skipped if the server uses host attributes.", "Clarified that the [epp-06](#Test-Case-epp-06) test case will be skipped if the `general.registryDataModel` input parameter is `minimum`.", "Updated the wording of [epp-08](#Test-Case-epp-08) to clarify that both `` and `` commands will be used.", "Updated [epp-04](#Test-Case-epp-04) to clarify that the [`epp.registeredNames`](#Input-Parameter-epp.registeredNames) input parameter will be used in this test case.", "Added [idn-02](#Test-Case-idn-02) which checks that the EPP server rejects `` commands for pure ASCII domains in TLDs that are IDN-only.", "Added [idn-06](#Test-Case-idn-06) which checks that the EPP server rejects `` commands for domains that do not comply with the requirements of IDNA2008.", "Updated [idn-01](#Test-Case-idn-01) to include `` commands for valid and invalid labels.", "Input parameters now have a boolean `Required` parameter indicating whether they are required or optional. Where the description of the input parameter previously said that the value must be empty, it now says it must be omitted.", "If a port is specified in an RDAP Base URL, it **MUST** be `443`.", "The [`DNS_INCONSISTENT_RESPONSES`](#Error-DNS_INCONSISTENT_RESPONSES) error\nhas been removed from all test cases in the DNS and DNSSEC test cases, and a\nnew test case, [dns-zz-consistency](#Test-Case-dns-zz-consistency) has been\nadded which will perform consistency checks using the SLA Monitoring system\n(SLAM).\n", "The [`dns.nameservers`](#Input-Parameter-dns.nameservers) input parameter has\nbeen updated to add the `supportsDoT`, `supportsDoH` and `supportsDoQ`\nboolean flags to nameservers. This allows test subjects to indicate whether\na nameserver supports DoT, DoH or DoQ, respectively.\n" ], "2024-06-26" : [ "Correct errors in [epp-12](#Test-Case-epp-12).", "Added the [`srsgw.domainCreateExtension`](#Input-Parameter-srsgw.domainCreateExtension),\n[`srsgw.domainDeleteExtension`](#Input-Parameter-srsgw.domainDeleteExtension),\n[`srsgw.domainRenewExtension`](#Input-Parameter-srsgw.domainRenewExtension),\n[`srsgw.domainTransferRequestExtension`](#Input-Parameter-srsgw.domainTransferRequestExtension) and\n[`srsgw.domainTransferApproveExtension`](#Input-Parameter-srsgw.domainTransferApproveExtension)\ninput parameters, and the [`SRSGW_EPP_INVALID_EXTENSION`](#Error-SRSGW_EPP_INVALID_EXTENSION) error.\n", "Added the [Additional DNS Transports](#Test-Plan-AdditionalDNSTransportsTest) plan.", "The [RDAP test suite](#Test-Suite-StandardEPP) has been significantly\nrefactored to split out separate test cases for [domain](#Test-case-rdap-01),\n[nameserver](#Test-case-rdap-02), [registrar](#Test-case-rdap-03) and\n[help](#Test-case-rdap-04) queries. The test coverage has not changed (since\nthe RDAP Conformance Tool will still be used), this change is mainly to\nensure that any errors are properly associated with the type of query being\nperformed.\n" ], "2024-07-03" : [ "The [epp-07](#Test-Case-epp-07) and [epp-09](#Test-Case-epp-09) test cases\nhave been updated to use the newly-added\n[`epp.supportedContactElements`](#Input-Parameter-epp.supportedContactElements)\nand [`epp.requiredContactElements`](#Input-Parameter-epp.requiredContactElements)\ninput parameters.\n", "The [epp-07-data](#Data-Provider-epp-07-data) data provider has been updated\nto correct the error codes generated when the server accepts a ``\nelement with invalid content.\n", "The [`dns.nameservers`](#Input-Parameter-dns.nameservers) input parameter\nhas been updated to allow different nameservers to be specified for each TLD\nbeing tested. The description of the [DNS](#Test-Suite-StandardDNS) has been\nupdated to reflect this change.\n", "Documented [Test TLDs for RSP\nEvaluation](#Preamble-2.6.-Test-TLDs-for-RSP%0AEvaluation).\n", "Updated the test cases in the [Integration test\nsuite](#Test-Suite-StandardIntegrationTest) to be independent from each\nother.\n" ], "2024-07-17" : [ "EPP-related test cases are being revised to avoid reuse of objects created\nprevious test cases. Instead, each test case will be \"standalone\", and will\ncreated any required objects itself. Any such objects will be deleted when\nthe test case is finished. Any test case that still describes the reuse of\nobjects created in a previous test case will eventually be updated to become\n\"standalone\" and should be read as such.\n", "Fixed the type of [`srsgw.serverIssuedClientCertificate01`](#Input-Parameter-srsgw.serverIssuedClientCertificate01).", "Revised the error codes for [epp-07](#Test-Case-epp-07), and the data\nprovider, so that elements that can be empty do not result in errors when\nempty values are accepted by the server.\n", "Clarified the relationship between the items in the\n[`epp.registeredNameservers`](#Input-Parameter-epp.registeredNameservers)\ninput parameters and the TLDs in the TLD set. This input parameter is now\nalso optional.\n", "Updated the definition of the\n[`epp.registeredContacts`](#Input-Parameter-epp.registeredContacts) to make\na bit more sense. This is also now optional.\n", "Added a list of namespace URIs to [rde-05](#Test-Case-rde-05).", "Updated the test procedure for [srsgw-15](#Test-Case-srsgw-15), and added a\nreference to [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785). The two\nRDAP responses may have different \"last update of RDAP database\" events.\n", "Added data providers to [epp-13](#Test-Case-epp-13) and\n[epp-14](#Test-Case-epp-14).\n" ], "2024-07-24" : [ "Clarified the description of [epp-17](#Test-Case-epp-17)." ], "2024-07-31" : [ "The schema has been updated to add an `Implemented` property to test cases,\nallowing the proportion of implemented test cases to be reported for each\nsuite and plan.\n", "Added data providers to some EPP test cases.", "Resolved error message inconsistency in [epp-16](#Test-Case-epp-16).", "Further clarifications to [epp-17](#Test-Case-epp-17).", "Made [epp-18](#Test-Case-epp-18) standalone.", "Made [epp-19](#Test-Case-epp-19) standalone.", "Made [epp-21](#Test-Case-epp-21) standalone.", "Made [epp-22](#Test-Case-epp-22) standalone." ], "2024-08-20" : [ "Added a data provider to [epp-11](#Test-Case-epp-11)." ], "2024-08-30" : [ "Fixed test data sets in [epp-11-data](#Data-Provider-epp-11-data)." ], "2024-09-04" : [ "Upgraded **SHOULD** to **MUST** for\n[`epp.serverIssuedClientCertificate01`](#Input-Parameter-epp.serverIssuedClientCertificate01),\n[`epp.serverIssuedClientCertificate02`](#Input-Parameter-epp.serverIssuedClientCertificate02),\n[`epp.registeredNameservers`](#Input-Parameter-epp.registeredNameservers) and\n[`epp.registeredContacts`](#Input-Parameter-epp.registeredContacts).\n", "Clarified that the values of the\n[`dnssecOps.zskRolloverZone`](#Input-Parameter-dnssecOps.zskRolloverZone),\n[`dnssecOps.kskRolloverZone`](#Input-Parameter-dnssecOps.kskRolloverZone),\n[`dnssecOps.algorithmRolloverZone`](#Input-Parameter-dnssecOps.algorithmRolloverZone)\ninput parameters must be different.\n", "The [`rdap.testDomains`](#Input-Parameter-rdap.testDomains) parameter is\nnow an object with the same schema as the other input parameters for the\nRDAP suite.\n", "Added the [`rdap.profileVersion`](#Input-Parameter-rdap.profileVersion) input parameter." ], "2024-09-12" : [ "The version of Zonemaster that the DNS and DNSSEC test suites use has been\nchanged from `2023.1.4` to `2024.1`. The changes in Zonemaster between these\nversions may be found in the [release\nnotes](https://github.com/zonemaster/zonemaster/releases/) on GitHub.\n", "`idn-01`, `idn-02`, `idn-03`, `idn-04` and `idn-06` have been folded into a\n[single test case (a new `idn-01`)](#Test-Case-idn-01), as a single\nimplementation will perform all the tests.\n", "As a result of the above, `idn-05` is now [`idn-02`](#Test-Case-idn-02).", "In [epp-20](#Test-Case-epp-20), the domain must not have the `pendingTransfer`\nstatus after the transfer is rejected.\n", "Clarified how the [`epp.restoreReportRequired`](#Input-Parameter-epp.restoreReportRequired)\ninput parameter affects the restore request in [epp-22](#Test-Case-epp-22).\n", "Updated [epp-23](#Test-Case-epp-23) to be stand-alone and also use a data\nprovider.\n", "Updated [epp-24](#Test-Case-epp-24) to be stand-alone.", "Added informative references to each test suite." ], "2024-09-18" : [ "Updates to test cases in the [RDE test suit](#Test-Suite-StandardRDE)\nresulting from internal review.\n", "Several EPP-related input parameters now have [SRS\nGateway](#Test-Suite-StandardSRSGateway)-specific equivalents, as it is\npossible to allow the SRS Gateway EPP server to have a different data model\nto the primary EPP server.\n", "Clarified that IP-related tests are only applicable for internal hosts in\n[epp-13](#Test-Case-epp-13).\n", "Replaced the `epp.clientCertificate` and `epp.clientCSR` resources with\n[`epp.client01Certificate`](#Resource-epp.client01Certificate) and\n[`epp.client02Certificate`](#Resource-epp.client02Certificate), and\n[`epp.client01CSR`](#Resource-epp.client01CSR) and\n[`epp.client02CSR`](#Resource-epp.client02CSR) respectively, so each\nclient can use a distinct certificate.\n" ], "2024-09-25" : [ "The [`epp.clientACL`](#resource-epp.clientACL),\n[`integration.rdeSFTPACL`](#resource-integration.rdeSFTPACL) and\n[`dnssecOps.xfrACL`](#resource-dnssecOps.xfrACL) resources may now contain\nCIDR prefixes as well as IP addresses.\n", "Added [`EPP_GENERIC_COMMAND_ERROR`](#Error-EPP_GENERIC_COMMAND_ERROR) to all\nEPP-related test cases.\n" ], "2024-10-02" : [ "Miscellaneous minor fixes.", "Fixed the schema for the\n[`srsgw.eppRequiredContactElements`](#Input-Parameter-srsgw.eppRequiredContactElements)\ninput parameter.\n" ], "2024-10-09" : [ "Miscellaneous minor fixes." ], "2024-10-16" : [ "Updated the test procecdure for [epp-19](#Test-Case-epp-19) so that the\nauthInfo code is set during an `` rather than ``, to account\nfor servers that implement RFC 9154 and reject non-empty authInfo elements\nduring `` commands. Also added the\n[`EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO`](#Error-EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO)\nerror code for when the server rejects an authInfo code that it should\naccept.\n", "Fix typo in [idn-01](#Test-Case-idn-01) that made the description of the\nrules for variants logically incoherent.\n", "Added\n[`RDE_DOMAIN_HAS_MISSING_CONTACT`](#Error-RDE_DOMAIN_HAS_MISSING_CONTACT)\nand\n[`RDE_DOMAIN_HAS_MISSING_NAMESERVER`](#Error-RDE_DOMAIN_HAS_MISSING_NAMESERVER)\nto [rde-07](#Test-case-rde-07).\n", "Fixed the description of\n[`RDE_DOMAIN_HAS_MISSING_REGISTRANT`](#Error-RDE_DOMAIN_HAS_MISSING_REGISTRANT).\n", "Clarified that domain and host names, and domain, host and contact ROIDs must be unique. Added the [`RDE_DOMAIN_HAS_NON_UNIQUE_NAME`](#Error-RDE_DOMAIN_HAS_NON_UNIQUE_NAME), [`RDE_HOST_HAS_NON_UNIQUE_NAME`](#Error-RDE_HOST_HAS_NON_UNIQUE_NAME), [`RDE_DOMAIN_HAS_NON_UNIQUE_ROID`](#Error-RDE_DOMAIN_HAS_NON_UNIQUE_ROID), [`RDE_HOST_HAS_NON_UNIQUE_ROID`](#Error-RDE_HOST_HAS_NON_UNIQUE_ROID) and [`RDE_CONTACT_HAS_NON_UNIQUE_ROID`](#Error-RDE_CONTACT_HAS_NON_UNIQUE_ROID) error codes as needed to [rde-08](#Test-Case-rde-08), [rde-09](#Test-Case-rde-09) and [rde-10](#Test-Case-rde-10).", "Added\n[`EPP_HOST_DELETE_RESPONSE_NOT_1000_OR_1001`](#Error-EPP_HOST_DELETE_RESPONSE_NOT_1000_OR_1001)\nto [epp-24](#Test-Case-epp-24).\n" ], "2024-10-23" : [ "Updated the test procedure for [srsgw-13](#Test-Case-srsgw-13) to be\nstand-alone. The same change will be made to most of the other test cases in\nthe SRS Gateway test suite; stay tuned for updates.\n", "Standardized the definition of \"canonicalization\" across\n[srsgw-13](#Test-Case-srsgw-13), [srsgw-14](#Test-Case-srsgw-15) and\n[srsgw-15](#Test-Case-srsgw-15).\n", "Added EPP-related error codes to [srsgw-13](#Test-Case-srsgw-13),\n[srsgw-14](#Test-Case-srsgw-15) and [srsgw-15](#Test-Case-srsgw-15).\n", "Fixed typo in reference to [RFC\n5890](https://www.rfc-editor.org/rfc/rfc5890.html) in\n[dns-zz-idna2008-compliance](#Test-Case-dns-zz-idna2008-compliance).\n" ], "2024-11-06" : [ "Updates to:\n\n* [srsgw-05](#Test-Case-srsgw-05)\n* [srsgw-06](#Test-Case-srsgw-06)\n* [srsgw-07](#Test-Case-srsgw-07)\n* [srsgw-08](#Test-Case-srsgw-08)\n* [srsgw-09](#Test-Case-srsgw-09)\n* [rde-14](#Test-Case-rde-14)\n" ], "2024-11-13" : [ "Added the [`idn.testLabelsForOTE`](#Resource-idn.testLabelsForOTE) resource\nto the IDN test suite.\n" ], "2024-11-20" : [ "Added a new test plan called [Pre-Delegation Test with SRS\nGateway](#Test-Plan-PreDelegationTestWithSRSGateway), for TLDs that are\nlaunching with an SRS Gateway. This test plan uses the same test suites as\nthe [Pre-Delegation Test](#Test-Plan-StandardPreDelegationTest) plan plus\nthe [SRS Gateway](#Test-Suite-StandardSRSGateway) test suite.\n", "Removed the `RDE_POLICY_OBJECT_UNEXPECTED_OBJECTS` error from\n[rde-14](#Test-Case-rde-14).\n", "Resolved an ordering issue in\n[epp-16-status-data](#Data-Provider-epp-16-status-data).\n", "Clarified that there must be entry in the [`rdap.baseURLs`](#Input-Parameter-rdap.baseURLS)\ninput parameter for each TLD being tested.\n" ], "2024-12-04" : [ "Updated the format for test TLDs for RSP evaluation.", "Fixed an issue with the HTML generator which resulted in boolean values being represented in examples as `1` and `0` instead of `true` and `false`.", "Updates to:\n\n* [srsgw-09](#Test-Case-srsgw-09)\n* [srsgw-10](#Test-Case-srsgw-10)\n* [srsgw-11](#Test-Case-srsgw-11)\n* [srsgw-12](#Test-Case-srsgw-12)\n* [srsgw-14](#Test-Case-srsgw-14)\n", "`srsgw-07` has been merged with [srsgw-06](#Test-Case-srsgw-06) and no\nlonger exists.\n" ], "2024-12-11" : [ "Added the [`RST_EXCEPTION`](#Error-RST_EXCEPTION) error, which may be\nemitted by any test case, and indicates that an internal exception has\noccurred.\n", "Updated [epp-19](#Test-Case-epp-19) to avoid the use of the EPP message\nqueue.\n", "Added [`EPP_TRANSFER_NOT_PROCESSED`](#Error-EPP_TRANSFER_NOT_PROCESSED) to\n[epp-19](#Test-Case-epp-19).\n" ], "2024-12-18" : [ "Added the\n[`EPP_RESTORE_DOMAIN_NOT_RENEWPERIOD`](#Error-EPP_RESTORE_DOMAIN_NOT_RENEWPERIOD)\nand [`EPP_RESTORE_DELETE_FAILED`](#Error-EPP_RESTORE_DELETE_FAILED) errors\nto [epp-22](#Test-Case-epp-22).\n", "Added the\n[`RPMS_INVALID_CLAIMS_KEY`](#Error-RPMS_INVALID_CLAIMS_KEY) error\nto [minimumRPMs-01](#Test-Case-minimumRPMs-01).\n", "Fixed a syntax error in\n[epp-14-data](#Data-Provider-epp-14-data).\n", "Added the\n[`EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO`](#Error-EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO),\n[`EPP_TRANSFER_SERVER_ACCEPTS_INCORRECT_AUTHINFO`](#Error-EPP_TRANSFER_SERVER_ACCEPTS_INCORRECT_AUTHINFO),\nand\n[`EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_STATUS_CODE`](#Error-EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_STATUS_CODE)\nerrors to to [epp-20](#Test-Case-epp-20).\n" ], "2025-01-08" : [ "The `epp-22` (domain restore test) test case has been removed, since it is\nnot possible to reliably restore a domain with the `addPeriod` RGP status.\n", "Fixed the format of the Test TLDs for RSP Evaluation.", "The `Implemented` property of test cases has been removed as completion of\ninitial development approaches.\n", "Added [`DNSSEC_OPS_INVALID_ALGORITHM`](#Error-DNSSEC_OPS_INVALID_ALGORITHM)\nto [dnssecOps01-ZSKRollover](#Test-Case-dnssecOps01-ZSKRollover) and\n[dnssecOps02-KSKRollover](#Test-Case-dnssecOps02-KSKRollover).\n", "The rules for computation of domain and host names in data providers have\nbeen revised to improve consistency and reduce the probability of\ncollisions.\n" ], "2025-01-14" : [ "Added the [`epp-16-dnssec-data`](#Data-Provider-epp-16-dnssec-data) data\nprovider to [epp-16](#Test-Case-epp-16).\n", "Added the\n[`EPP_HOST_RENAME_OBJECT_NOT_RENAMED`](#Error-EPP_HOST_RENAME_OBJECT_NOT_RENAMED)\nerror to [epp-23](#Test-Case-epp-23).\n", "Added the\n[`SRSGW_DOMAIN_RENEW_INCORRECT_EXPIRY_DATE`](#Error-SRSGW_DOMAIN_RENEW_INCORRECT_EXPIRY_DATE)\nerror to [srsgw-05](#Test-Case-srsgw-05).\n", "Made [`RDE_DECRYPTION_FAILED`](#Error-RDE_DECRYPTION_FAILED) a CRITICAL\nerror.\n", "Fixed a ordering issue in\n[epp-11-data](#Data-Provider-epp-11-data).\n" ], "2025-01-22" : [ "Replaced `RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_EXPIRED_SMD` with\n[`RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_SMD`](#Error-RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_SMD)\nin\n[minimumRPMs-02](#Test-Case-minimumRPMs-02) as the TMCH doesn't provide an\nexpired test SMD, only an invalid test SMD.\n", "Updates to [epp-14](#Test-Case-epp-14), to update the syntax of randomly-\ngenerated domain names, and remove the tests of the admin, tech and billing\ncontacts.\n", "The `minimumRPMS.sunriseModels` input parameter has been renamed to\n[`minimumRPMS.sunriseModel`](#ut-Parameter-minimumRPMS.sunriseModel), and\nthe value `both` has been removed from the enum of possible values.\n" ], "2025-01-28" : [ "Fixed the wording of [srsgw-06](#Test-Case-srsgw-06).\n", "Added\n[`EPP_DOMAIN_TRANSFER_REQUEST_FAILED`](#Error-EPP_DOMAIN_TRANSFER_REQUEST_FAILED)\nto [epp-19](#Test-Case-epp-19).\n", "Updated [dns-zz-consistency](#Test-Case-dns-zz-consistency).\n" ], "2025-02-05" : [ "Added\n[`RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_EXPIRED_CLAIM_KEY`](#Error-RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_EXPIRED_CLAIM_KEY)\nto [minimumRPMs-03](#Test-Case-minimumRPMs-03).\n" ], "2025-02-12" : [ "Added [`DNSSEC_DNS_QUERY_ERROR`] to [dnssec-92](#Test-Case-dnssec-92) and\n[dnssec-93](#Test-Case-dnssec-93).\n", "Updated the description of the\n[`idn.testLabelsForOTE`](#Resource-idn.testLabelsForOTE) resource to provide\nmore information, and an updated URL. The URL is not currently available to\nthe public but will be made available in the near future.\n" ], "2025-02-21" : [ "The data provider for [epp-14](#Test-Case-epp-14) has been updated to ensure\nthat it will pass for IDN-only TLDs.\n" ], "2025-02-26" : [ "To avoid issues where EPP servers reject commands containing IP addresses in\nthe RFC 1918 and RFC 5156 registries, data providers which use addresses\nfrom these registries have been updated to use globally-routable IPv4 and\nIPv6 addresses, as applicable, from prefixes assigned to ICANN. These\nprefixes have been reserved for use for this purpose.\n", "Updated [dnssec-92](#Test-Case-dnssec-92) to disallow algorithm 12 (GOST R\n34.10-2001).\n" ], "2025-03-05" : [ "Added\n[`RDE_MENU_AND_HEADER_URIS_DIFFER`](#Error-RDE_MENU_AND_HEADER_URIS_DIFFER)\nto [rde-05](#Test-Case-rde-05).\n" ], "2025-03-07" : [ "Fixed the error codes in [`epp-16-ns-data`](#Data-Provider-epp-16-ns-data).\n", "Removed `epp.registeredNames`(#Input-Parameter-epp.registeredNames) from the\ninput parameters for the [Minimum RPMs](#Test-Suite-MinimumRPMs) suite.\n", "Set the `Required` property of\n[`srsgw.serverIssuedClientCertificate01`](#Input-Parameter-srsgw.serverIssuedClientCertificate01)\nand\n[`srsgw.serverIssuedClientCertificate02`](#Input-Parameter-srsgw.serverIssuedClientCertificate02)\nto `false`.\n", "Added\n[`RDE_DOMAIN_OBJECT_MISSING`](#Error-RDE_DOMAIN_OBJECT_MISSING),\n[`RDE_HOST_OBJECT_MISSING`](#Error-RDE_HOST_OBJECT_MISSING),\n[`RDE_CONTACT_OBJECT_MISSING`](#Error-RDE_CONTACT_OBJECT_MISSING) and\n[`RDE_REGISTRAR_OBJECT_MISSING`](#Error-RDE_REGISTRAR_OBJECT_MISSING) to the\nrespective test cases in the [RDE test suite](#Test-Suite-StandardRDE).\n" ], "2025-03-11" : [ "Clarified the text of [rde-05](#Test-Case-rde-05) and\n[rde-06](#Test-Case-rde-06).\n", "Added\n[`RDE_MISSING_EPP_PARAMS_OBJECT`](#Error-RDE_MISSING_EPP_PARAMS_OBJECT) to\n[rde-13](#Test-Case-rde-13).\n" ], "2025-03-20" : [ "[`RDE_SCHEMA_VALIDATION_ERROR`](#Error-RDE_SCHEMA_VALIDATION_ERROR) and\n[`RDE_XML_PARSE_ERROR`](#Error-RDE_XML_PARSE_ERROR) now have the `CRITICAL`\nseverity.\n", "Added\n[`RDE_UNEXPECTED_OBJECT`](#Error-RDE_UNEXPECTED_OBJECT) to\n[rde-06](#Test-Case-rde-06).\n" ], "2025-03-27" : [ "Version v2025.01. There are no significant changes since the last release except the version number." ], "2025-04-10" : [ "Version v2025.02:", "Fix the example in [`dnssecOps.nameservers`](#Input-Parameter-dnssecOps.nameservers) ([#1](https://github.com/icann/rst-test-specs/issues/1)).", "Update [`idn.testLabelsForOTE`](#idn.testLabelsForOTE) to v1.0.2 ([#17](https://github.com/icann/rst-test-specs/issues/17)).", "In [dns-zz-consistency](#Test-Case-dns-zz-consistency), clarify that a secure delegation for the \"nic\" zone **MUST** be present in the TLD zone ([#16](https://github.com/icann/rst-test-specs/issues/16))." ], "2025-04-25" : [ "Version v2025.03:", "Describe the use of `.icann` for external nameserver hostnames ([#9](https://github.com/icann/rst-test-specs/issues/9))", "Allow `v4Addrs` and `v6Addrs` to be optional in [`dnssecOps.nameservers`](#Input-Parameter-dnssecOps.nameservers) ([#11](https://github.com/icann/rst-test-specs/issues/11))", "Clarify that the [`epp.supportedContactElements`](#Input-Parameter-epp.supportedContactElements) and [`epp.requiredContactElements`](#Input-Parameter-epp.requiredContactElements) input parameters **MUST** be empty if the value of the [`general.registryDataModel`] input parameter is `minimum` ([#23](https://github.com/icann/rst-test-specs/issues/23))", "Describe the use of `ICANNRST` as an EPP repository ID that may be used in RSP evaluation tests and OT&E ([#24](https://github.com/icann/rst-test-specs/issues/24))", "Add a new `hostModel` column to [`epp-16-ns-data`](#Data-Provider-epp-16-ns-data) ([#28](https://github.com/icann/rst-test-specs/issues/28))" ], "2025-07-09" : [ "Version [v2025.04](https://github.com/icann/rst-test-specs/releases/tag/v2025.04):", "The schema of the [dnssecOps.primaryServers](#Input-Parameter-dnssecOps.primaryServers)\ninput parameter has been relaxed to not require at least one IP address of\neach type: one address of either type is accepted (see\n[#47](https://github.com/icann/rst-test-specs/issues/47)).\n", "The following new input parameters have been added:\n\n * [`epp.loginExtension`](#Input-Parameter-epp.loginExtension)\n (see [#42](https://github.com/icann/rst-test-specs/issues/42))\n * [`idn.domainCreateExtension`](#Input-Parameter-idn.domainCreateExtension)\n (see [#39](https://github.com/icann/rst-test-specs/issues/39))\n * [`srsgw.loginExtension`](#Input-Parameter-srsgw.loginExtension)\n (see [#43](https://github.com/icann/rst-test-specs/issues/43))\n", "The following new error codes have been added:\n\n * [`EPP_INVALID_EXTENSION`](#Error-EPP_INVALID_EXTENSION)\n * [`EPP_INVALID_IDN_EXTENSION`](#Error-EPP_INVALID_IDN_EXTENSION)\n", "Renamed the error codes in [minimumRPMs-03](#Test-Case-minimumRPMs-03) to\nfix use the correct terminology (see\n[#20](https://github.com/icann/rst-test-specs/issues/20)).\n", "Added the [`DNSSECOperationsOnly`](#Test-Plan-DNSSECOperationsOnly) and\n[`StandardIntegrationTestOnly`](#Test-Plan-StandardIntegrationTestOnly)\ntest plans, to allow the [DNSSEC Operations](#Test-Suite-DNSSECOperations)\nand [Integration](#Test-Suite-StandardIntegrationTest) test suites to be\ntested separately in OT&E\n(see [#5](https://github.com/icann/rst-test-specs/issues/5)).\n", "Added the [`rdap.clientACL`](#Resource-rdap.clientACL) resource\n(see [#3](https://github.com/icann/rst-test-specs/issues/3)).\n", "Updated the [epp-14-data](#Data-Provider-epp-14-data) data provider, adding\na column to identify which value of the\n[`epp.secDNSInterfaces`](#Input-Parameter-epp.secDNSInterfaces) input\nparameter each row is applicable to (see\n[#50](https://github.com/icann/rst-test-specs/issues/50)).\n" ], "2025-08-14" : [ "Version [v2025.05](https://github.com/icann/rst-test-specs/releases/tag/v2025.05):", "[`DNSSEC_OPS_ZONE_IS_INVALID`](#Error-DNSSEC_OPS_ZONE_IS_INVALID) has been\ndowngraded from `CRITICAL` to `ERROR` severity (see\n[#37](https://github.com/icann/rst-test-specs/issues/37)).\n", "The schema for the\n[`epp.loginExtension`](#Input-Parameter-epp.loginExtension) input parameter\nhas been fixed (see\n[#57](https://github.com/icann/rst-test-specs/issues/57)).\n", "The test specs now includes a configuration file for the [RDAP Conformance\nTool](https://github.com/icann/rdap-conformance-tool) (see\n[#59](https://github.com/icann/rst-test-specs/issues/59)).\n", "The description of the [epp-13](#Test-Case-epp-13) test case has been\nupdated to clarify that internal host names will be used.\n", "The description of the [epp-14](#Test-Case-epp-14) test case has been\nupdated to clarify that contact objects will only be created if the\n[`general.registryDataModel`](#Input-Parameter-general.registryDataModel)\ninput parameter is `maximum` or `per-registrar`.\n" ], "2025-09-01" : [ "Version [v2025.06](https://github.com/icann/rst-test-specs/releases/tag/v2025.06):", "Added the\n[`RDE_DOMAIN_HAS_INVALID_CRRR`](#Error-RDE_DOMAIN_HAS_INVALID_CRRR),\n[`RDE_DOMAIN_HAS_INVALID_UPRR`](#Error-RDE_DOMAIN_HAS_INVALID_UPRR),\n[`RDE_DOMAIN_HAS_INVALID_RERR`](#Error-RDE_DOMAIN_HAS_INVALID_RERR) and\n[`RDE_DOMAIN_HAS_INVALID_ACRR`](#Error-RDE_DOMAIN_HAS_INVALID_ACRR) error\ncodes to [rde-07](#Test-Case-rde-07) (see\n[#53](https://github.com/icann/rst-test-specs/issues/53)).\n", "Added the [`epp.client01ChainCert`](#Resource-epp.client01ChainCert) and [`epp.client02ChainCert`](#Resource-epp.client02ChainCert) resources (see [#63](https://github.com/icann/rst-test-specs/issues/63)).", "The schema for the [`rdap.profileVersion`](#Input-Parameter-rdap.profileVersion) input parameter has been updated to reflect the retirement of the February-2019 profile (see [#64](https://github.com/icann/rst-test-specs/issues/64)).", "Fixed an issue with the script that generates the RDAP Conformance Tool configuration file.", "Ensure EPP-related resources are referenced by all suites that relate to\nEPP.\n" ], "2025-10-02" : [ "Version [v2025.07](https://github.com/icann/rst-test-specs/releases/tag/v2025.07):", "Account for out-of-band purge of the domain in\n[epp-21](#Test-Case-epp-21) and [srsgw-08](#Test-Case-srsgw-08)\n([#6](https://github.com/icann/rst-test-specs/issues/6))\n", "[epp-08](#Test-Case-epp-08): do not expect the 2201 code\n([#54](https://github.com/icann/rst-test-specs/issues/54))\n", "[srsgw-08](#Test-Case-srsgw-08): incorrect expected RGP status after\n`` ([#69](https://github.com/icann/rst-test-specs/issues/69))\n", "[rdap-92](#Test-Case-rdap-92): ordering of objects in arrays\n([#61](https://github.com/icann/rst-test-specs/issues/61))\n", "Add unique ID to data provider rows\n([#87](https://github.com/icann/rst-test-specs/issues/87))\n", "[epp-16-dnssec-data](#Data-Provider-epp-16-dnssec-data): differentiate between\nsecDNS interfaces ([#78](https://github.com/icann/rst-test-specs/issues/78))\n", "Server use of error result code for `` for invalid domain/hostnames\ncauses issues in [epp-04](#Test-Case-epp-04), [epp-05](#Test-Case-epp-05)\nand [epp-06](#Test-Case-epp-06)\n([#62](https://github.com/icann/rst-test-specs/issues/62))\n", "Update to the EPP Extension Registry\n([#85](https://github.com/icann/rst-test-specs/issues/85))\n" ], "2025-11-25" : [ "Version [v2025.08](https://github.com/icann/rst-test-specs/releases/tag/v2025.08):", "Updates to the EPP Extension Registry\n([#94](https://github.com/icann/rst-test-specs/issues/94),\n([#102](https://github.com/icann/rst-test-specs/issues/102) and\n[#133](https://github.com/icann/rst-test-specs/issues/133)).\n", "Added\n[`epp.supportedContactPostalInfoTypes`](#Input-Parameter-epp.supportedContactPostalInfoTypes)\ninput parameter\n([#96](https://github.com/icann/rst-test-specs/issues/96)).\n", "Added\n[`RPMS_MISSING_CLAIMS_KEY`](#Error-RPMS_MISSING_CLAIMS_KEY)\n([#18](https://github.com/icann/rst-test-specs/issues/18)).\n", "Removed the `integration.rriACL` input parameter\n([#98](https://github.com/icann/rst-test-specs/issues/98)).\n", "[Configuration parameters](#config) are now included in HTML output\n([#108](https://github.com/icann/rst-test-specs/issues/108)).\n", "Minor fixes to [epp-02](#Test-Case-epp-02) and [epp-08](#Test-Case-epp-08)\n([#110](https://github.com/icann/rst-test-specs/issues/110) and\n[#113](https://github.com/icann/rst-test-specs/issues/113)).\n", "[epp-04](#Test-Case-epp-04), [epp-05](#Test-Case-epp-05) and\n[epp-06](#Test-Case-epp-06) have been updated so that they will accept any\nEPP error response when submitting a `` command for a syntactically\ninvalid domain name, host name, or contact ID\n([#115](https://github.com/icann/rst-test-specs/issues/115)).\n", "[epp-11](#Test-Case-epp-11) will no longer fail if the EPP server allows\ncreation of internal hosts without glue\n([#120](https://github.com/icann/rst-test-specs/issues/120)).\n", "Many SRS Gateway error codes have been downgraded from `CRITICAL` to `ERROR`\nseverity ([#125](https://github.com/icann/rst-test-specs/issues/125)).\n", "Minor fixes to several RDAP test cases\n([#129](https://github.com/icann/rst-test-specs/issues/129)).\n", "The build system will now generate separate RDAP Conformance Tool\nconfiguration files for the OT&E and production environments\n([#131](https://github.com/icann/rst-test-specs/issues/131)).\n", "Updated [`idn.testLabelsForOTE`](#Resource-idn.testLabelsForOTE) to\nthe latest version.\n" ], "2025-11-26" : [ "Version [v2025.08.1](https://github.com/icann/rst-test-specs/releases/tag/v2025.08.1):", "This release updates the configuration file(s) for the RDAP Conformance\nTool. There are no changes to the test specifications.\n" ], "2025-12-05" : [ "Version [v2025.09](https://github.com/icann/rst-test-specs/releases/tag/v2025.09):", "The [Configuration Parameters](#config) section has been updated to include\nthe version of the RDAP Conformance Tool that is used\n([#106](https://github.com/icann/rst-test-specs/issues/106)).\n", "[epp-03](#Test-Case-epp-03) has been updated to confirm that the server\nrejects a `` command with a valid client ID and password, but where\nthe client has not provided a certificate\n([#101](https://github.com/icann/rst-test-specs/issues/101)).\n", "The version of Zonemaster has been updated to 2024.2 (Zonemaster::Engine\nversion 7.0.0) ([#125](https://github.com/icann/rst-test-specs/issues/152)).\n", "[rdap-08](#Test-Case-rdap-08),\n[rdap-09](#Test-Case-rdap-09) and\n[rdap-10](#Test-Case-rdap-10)\nhave been added to the [RDAP Test\nSuite](#Test-Suite-StandardRDAP) to verify correct behaviour of servers that\nreceive queries for non-existent domain, nameserver or entity objects\n([#76](https://github.com/icann/rst-test-specs/issues/76)).\n", "[epp-25](#Test-Case-epp-25) has been added\n([#73](https://github.com/icann/rst-test-specs/issues/73)).\n", "[srsgw-08](#Test-Case-srsgw-08) has been updated to correct an\nerror where the spec erroneously expects that a `` command will\nremove the `addPeriod` RGP status (due to [Erratum\n8305](https://www.rfc-editor.org/errata/eid8305))\n([#13](https://github.com/icann/rst-test-specs/issues/13)).\n" ], "2026-01-05" : [ "Version [v2026.01](https://github.com/icann/rst-test-specs/releases/tag/v2026.01):", "Allow auto-creation of external hosts in [epp-16](#Test-Case-epp-16)\n([#151](https://github.com/icann/rst-test-specs/issues/151)).\n", "Correct test environment for RSP IDN Test\n([#168](https://github.com/icann/rst-test-specs/pull/168)).\n", "Updated [`idn.testLabelsForOTE`](#Resource-idn.testLabelsForOTE) to\nthe latest version\n([#169](https://github.com/icann/rst-test-specs/issues/169)).\n" ], "2026-01-26" : [ "Version [v2026.01.1](https://github.com/icann/rst-test-specs/releases/tag/v2026.01.1):", "Updated [`epp-16-ns-data`](#Data-Provider-epp-16-ns-data) to ensure all\nerror codes are included\n([#19](https://github.com/icann/rst-test-specs/issues/19)).\n", "Updated [epp-23](#Test-Case-epp-23) to check that the EPP server rejects\nrename commands for external host objects that have associations with\nobjects that are sponsored by a different client\n([#89](https://github.com/icann/rst-test-specs/issues/89)).\n", "Updated the [`rdap.baseURLs`](#Input-Parameter-rdap.baseURLs) and\n[`srsgw.rdapBaseURLs`](#Input-Parameter-srsgw.rdapBaseURLs) input parameters\nto require a trailing slash\n([#186](https://github.com/icann/rst-test-specs/issues/186)).\n", "Clarified that the `ICANNRST` repository ID MAY be used, not MUST\n([#188](https://github.com/icann/rst-test-specs/issues/188)).\n", "Account for differing interpretations of idempotency in EPP in\n[epp-16](#Test-Case-epp-16)\n([#190](https://github.com/icann/rst-test-specs/issues/190)).\n" ], "2026-02-13" : [ "Version [v2026.02](https://github.com/icann/rst-test-specs/releases/tag/v2026.02):\n", "Update DNS and DNSSEC test suites for Zonemaster v2025.2 ([#49](https://github.com/icann/rst-test-specs/issues/49))\n", "Update RDAP Conformance Tool to v3.1.0 ([#158](https://github.com/icann/rst-test-specs/issues/158))\n", "Use \"internal\" and \"external\" instead of \"in-bailiwick\" and \"out-of-bailiwick\" ([#199](https://github.com/icann/rst-test-specs/issues/199))\n", "[rdap-92](#Test-Case-rdap-92): add error code for 404 (etc) response ([#202](https://github.com/icann/rst-test-specs/issues/202))\n", "Issue with pattern for RDAP base URLs ([#204](https://github.com/icann/rst-test-specs/issues/204))\n", "Add error code for missing RDE deposit file(s) ([#212](https://github.com/icann/rst-test-specs/issues/212))\n" ], "2026-04-13" : [ "Version [v2026.03](https://github.com/icann/rst-test-specs/releases/tag/v2026.03):\n", "Update [rde-07](#Test-Case-rde-07) to add\n[`RDE_DOMAIN_HAS_UNEXPECTED_HOST_OBJECTS`](#Error-RDE_DOMAIN_HAS_UNEXPECTED_HOST_OBJECTS) and\n[`RDE_DOMAIN_HAS_UNEXPECTED_HOST_ATTRIBUTES`](#Error-RDE_DOMAIN_HAS_UNEXPECTED_HOST_ATTRIBUTES)\n([#52](https://github.com/icann/rst-test-specs/issues/52)).\n", "New input parameter [`dns.gluePolicy`](#Input-Parameter-dns.gluePolicy).\nThis input parameter is not currently used by any test cases, but will be\nused by new test cases to be added in a future release\n([#122](https://github.com/icann/rst-test-specs/issues/122)).\n", "Correct the length of the computed label in `epp-14-data-row-2` in the\n[`epp-14-data`](#Data-Provider-epp-14-data) data provider\n([#185](https://github.com/icann/rst-test-specs/issues/185)).\n", "Remove the `RDE_MIXED_TYPES` error code from [rde-04](#Test-Case-rde-04)\n([#219](https://github.com/icann/rst-test-specs/issues/219)).\n", "Fix the variable name in the\n[`epp-16-ns-data`](#Data-Provider-epp-16-ns-data)\ndata provider\n([#229](https://github.com/icann/rst-test-specs/issues/229)).\n" ], "2026-05-06" : [ "Version [v2026.04](https://github.com/icann/rst-test-specs/releases/tag/v2026.04):\n", "Add [`RDE_REGISTRAR_HAS_NON_UNIQUE_ID`](#Error-RDE_REGISTRAR_HAS_NON_UNIQUE_ID)\nand [`RDE_NNDN_HAS_NON_UNIQUE_NAME`](#Error-RDE_NNDN_HAS_NON_UNIQUE_NAME) ([#231](https://github.com/icann/rst-test-specs/issues/231))\n", "Remove `EPP_GREETING_DOES_NOT_MATCH` from [epp-02](#Test-Case-epp-02) and\nremove the `epp.greeting` input parameter. The [rde-13](#Test-Case-rde-13)\ntest case has been updated accordingly ([#233](https://github.com/icann/rst-test-specs/issues/233))\n", "Use Zonemaster v2025.2.1 ([#239](https://github.com/icann/rst-test-specs/issues/239))", "Add constraints to input parameters ([#242](https://github.com/icann/rst-test-specs/issues/242))" ] }, "Configuration" : [ { "Name" : "ZONEMASTER_VERSION", "Value" : "2025.2.1" }, { "Name" : "ZONEMASTER_ENGINE_VERSION", "Value" : "8.1.1" }, { "Name" : "RDAPCT_VERSION", "Value" : "3.1.0" } ], "Contact" : { "Email" : "globalsupport@icann.org", "Name" : "GDS Technical Services", "Organization" : "Internet Corporation for Assigned Names and Numbers (ICANN)" }, "Data-Providers" : { "epp-07-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : "Contact ID", "Name" : "id", "Type" : "string" }, { "Description" : "Postal Info type attribute", "Name" : "postalInfoType", "Type" : "string" }, { "Description" : "Contact Name", "Name" : "name", "Type" : "string" }, { "Description" : "Contact Org (if supported)", "Name" : "org", "Type" : "string" }, { "Description" : "Address line 1 (if supported)", "Name" : "street1", "Type" : "string" }, { "Description" : "Address line 2 (if supported)", "Name" : "street2", "Type" : "string" }, { "Description" : "Address line 3 (if supported)", "Name" : "street3", "Type" : "string" }, { "Description" : "City", "Name" : "city", "Type" : "string" }, { "Description" : "State or province (if supported)", "Name" : "sp", "Type" : "string" }, { "Description" : "Postal code (if supported)", "Name" : "pc", "Type" : "string" }, { "Description" : "Country code", "Name" : "cc", "Type" : "string" }, { "Description" : "Phone (if supported)", "Name" : "voice", "Type" : "string" }, { "Description" : "Voice extension (if supported)", "Name" : "voiceExt", "Type" : "string" }, { "Description" : "Fax (if supported)", "Name" : "fax", "Type" : null }, { "Description" : "Fax extension (if supported)", "Name" : "faxExt", "Type" : null }, { "Description" : "Email", "Name" : "email", "Type" : "string" }, { "Description" : "AuthInfo code", "Name" : "authInfo", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{AUTO}` means a pseudo-random value generated by a faker library that is syntactically correct as per the XML schema in RFC 5733.\r\n * `RANDCHARS(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9`.\r\n * `&` indicates concatenation.\r\n* An EPP command passes if the `code` attribute of the `` element in the response is less than or equal to 1999.\r\n* If the EPP server implements RFC 9154, then the `authInfo` field must be empty.\r\n* Country codes must be taken from the ISO-3166-alpha-2 list.", "Rows" : [ [ "epp-07-data-row-0", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "pass", "EPP_CONTACT_CREATE_INFO_RESPONSE_NOT_1000" ], [ "epp-07-data-row-1", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ID" ], [ "epp-07-data-row-2", "{RANDCHARS(17)}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ID" ], [ "epp-07-data-row-3", "{AUTO}", "tni", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" ], [ "epp-07-data-row-4", "{AUTO}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" ], [ "epp-07-data-row-5", "{AUTO}", "{AUTO}", "{EMPTY}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_NAME" ], [ "epp-07-data-row-6", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(256)}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ORG" ], [ "epp-07-data-row-7", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CITY" ], [ "epp-07-data-row-8", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CC" ], [ "epp-07-data-row-9", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_VOICE" ], [ "epp-07-data-row-10", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_EMAIL" ], [ "epp-07-data-row-11", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(256)}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ORG" ], [ "epp-07-data-row-12", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(256)}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_STREET" ], [ "epp-07-data-row-13", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{RANDCHARS(256)}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CITY" ], [ "epp-07-data-row-14", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "XX", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CC" ], [ "epp-07-data-row-15", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "U", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CC" ], [ "epp-07-data-row-16", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "USA", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CC" ], [ "epp-07-data-row-17", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+12345", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-18", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1111.1", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-19", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "55", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-20", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-21", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.123456789012345", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-22", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.a", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-23", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+a.1", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-07-data-row-24", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+12345", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-25", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1111.1", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-26", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "55", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-27", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-28", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.123456789012345", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-29", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+1.a", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-30", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "+a.1", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-07-data-row-31", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "example", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-07-data-row-32", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "example.example", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-07-data-row-33", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "@example.com", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-07-data-row-34", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "@", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-07-data-row-35", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(65) & \"@example.com\"}", "{AUTO}", "fail", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" ] ] }, "epp-09-other-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "Phone (if supported)", "Name" : "voice", "Type" : "string" }, { "Description" : "Voice extension (if supported)", "Name" : "voiceExt", "Type" : "string" }, { "Description" : "Fax (if supported)", "Name" : "fax", "Type" : null }, { "Description" : "Fax extension (if supported)", "Name" : "faxExt", "Type" : null }, { "Description" : "Email", "Name" : "email", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{AUTO}` means a pseudo-random value generated by a faker library that is syntactically correct as per the XML schema in RFC 5733.\r\n * `RANDCHARS(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9`.\r\n * `&` indicates concatenation.\r\n* An EPP command passes if the `code` attribute of the `` element in the response is less than or equal to 1999.\r\n* If the EPP server implements RFC 9154, then the `authInfo` field must be empty.\r\n* Country codes must be taken from the ISO-3166-alpha-2 list.", "Rows" : [ [ "epp-09-other-data-row-0", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-other-data-row-1", "chg", "+12345", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-2", "chg", "+1111.1", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-3", "chg", "55", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-4", "chg", "+1.", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-5", "chg", "+1.123456789012345", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-6", "chg", "+1.a", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-7", "chg", "+a.1", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" ], [ "epp-09-other-data-row-8", "chg", "{AUTO}", "{AUTO}", "+12345", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-9", "chg", "{AUTO}", "{AUTO}", "+1111.1", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-10", "chg", "{AUTO}", "{AUTO}", "55", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-11", "chg", "{AUTO}", "{AUTO}", "+1.", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-12", "chg", "{AUTO}", "{AUTO}", "+1.123456789012345", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-13", "chg", "{AUTO}", "{AUTO}", "+1.a", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-14", "chg", "{AUTO}", "{AUTO}", "+a.1", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" ], [ "epp-09-other-data-row-15", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "example", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-09-other-data-row-16", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "example.example", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-09-other-data-row-17", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "@example.com", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-09-other-data-row-18", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "@", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" ], [ "epp-09-other-data-row-19", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(65) & \"@example.com\"}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" ] ] }, "epp-09-postalinfo-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "Postal Info type attribute", "Name" : "postalInfoType", "Type" : "string" }, { "Description" : "Contact Name", "Name" : "name", "Type" : "string" }, { "Description" : "Contact Org (if supported)", "Name" : "org", "Type" : "string" }, { "Description" : "Address line 1 (if supported)", "Name" : "street1", "Type" : "string" }, { "Description" : "Address line 2 (if supported)", "Name" : "street2", "Type" : "string" }, { "Description" : "Address line 3 (if supported)", "Name" : "street3", "Type" : "string" }, { "Description" : "City", "Name" : "city", "Type" : "string" }, { "Description" : "State or province (if supported)", "Name" : "sp", "Type" : "string" }, { "Description" : "Postal code (if supported)", "Name" : "pc", "Type" : "string" }, { "Description" : "Country code", "Name" : "cc", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{AUTO}` means a pseudo-random value generated by a faker library that is syntactically correct as per the XML schema in RFC 5733.\r\n * `RANDCHARS(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9`.\r\n * `&` indicates concatenation.\r\n* An EPP command passes if the `code` attribute of the `` element in the response is less than or equal to 1999.\r\n* If the EPP server implements RFC 9154, then the `authInfo` field must be empty.\r\n* Country codes must be taken from the ISO-3166-alpha-2 list.", "Rows" : [ [ "epp-09-postalinfo-data-row-0", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-postalinfo-data-row-1", "chg", "tni", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" ], [ "epp-09-postalinfo-data-row-2", "chg", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" ], [ "epp-09-postalinfo-data-row-3", "chg", "{AUTO}", "{EMPTY}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_NAME" ], [ "epp-09-postalinfo-data-row-4", "chg", "{AUTO}", "{AUTO}", "{RANDCHARS(256)}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_ORG" ], [ "epp-09-postalinfo-data-row-5", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CITY" ], [ "epp-09-postalinfo-data-row-6", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CC" ], [ "epp-09-postalinfo-data-row-7", "chg", "{AUTO}", "{RANDCHARS(256)}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_ORG" ], [ "epp-09-postalinfo-data-row-8", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{RANDCHARS(256)}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STREET" ], [ "epp-09-postalinfo-data-row-9", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{RANDCHARS(256)}", "{AUTO}", "{AUTO}", "{AUTO}", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CITY" ], [ "epp-09-postalinfo-data-row-10", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "XX", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CC" ], [ "epp-09-postalinfo-data-row-11", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "U", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CC" ], [ "epp-09-postalinfo-data-row-12", "chg", "{AUTO}", "{AUTO}", "{AUTO}", "{AUTO}", "{EMPTY}", "{EMPTY}", "{AUTO}", "{AUTO}", "{AUTO}", "USA", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CC" ] ] }, "epp-09-status-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "Status Code", "Name" : "status", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n* Any row containing an \"action\" value of \"add\" and a passOrFail value of \"pass\" should result in an object property being added, which will be validated using an `` command.\r\n* The cell values for rows with action=rem do not occur in previous rows, so the objects should not have those properties, meaning a successful response is an error.", "Rows" : [ [ "epp-09-status-data-row-0", "add", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-status-data-row-1", "add", "clientUpdateProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-2", "rem", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-status-data-row-3", "add", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-status-data-row-4", "add", "clientDeleteProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-5", "add", "clientHold", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-6", "add", "linked", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-7", "add", "ok", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-8", "add", "pendingCreate", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-9", "add", "pendingDelete", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-10", "add", "pendingTransfer", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-11", "add", "pendingUpdate", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-12", "add", "serverDeleteProhibited", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-13", "add", "serverUpdateProhibited", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-14", "add", "invalidStatusCode", "fail", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-09-status-data-row-15", "rem", "clientUpdateProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-16", "rem", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-09-status-data-row-17", "rem", "clientDeleteProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-18", "rem", "ok", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-19", "rem", "pendingCreate", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-20", "rem", "pendingDelete", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-21", "rem", "pendingTransfer", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-22", "rem", "pendingUpdate", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-23", "rem", "serverDeleteProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-24", "rem", "serverUpdateProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-09-status-data-row-25", "rem", "invalidStatusCode", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ] ] }, "epp-11-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : "Hostname", "Name" : "name", "Type" : "string" }, { "Description" : "Whether the superordinate domain name should be created before the subordinate host name is created (if it does not already exist)", "Name" : "createParentFirst", "Type" : "boolean" }, { "Description" : "IP Version", "Name" : "ip", "Type" : "string" }, { "Description" : "IP Address", "Name" : "addr", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{PREVIOUS}` indicates that the value computed from the same column in the preceding row should be used.\r\n", "Rows" : [ [ "epp-11-data-row-0", "{\"ns1.epp-11.rst.\" & RANDCHARS(18) & \".icann\"}", "false", "{EMPTY}", "{EMPTY}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-11-data-row-1", "{\"!.epp-11.rst.\" & RANDCHARS(18) & \".icann\"}", "false", "{EMPTY}", "{EMPTY}", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_HOSTNAME" ], [ "epp-11-data-row-2", "{\"ns1.epp-11.rst.\" & RANDCHARS(18) & \".\" & $TLD}", "false", "{EMPTY}", "{EMPTY}", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_HOSTNAME" ], [ "epp-11-data-row-3", "{PREVIOUS}", "true", "v4", "208.77.190.196", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-11-data-row-4", "{\"ns2.epp-11.rst.\" & RANDCHARS(18) & \".\" & $TLD}", "true", "v4", "{EMPTY}", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-5", "{PREVIOUS}", "true", "v4", "2602:800:900e:1257::4", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-6", "{PREVIOUS}", "true", "v4", "208.77.190", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-7", "{PREVIOUS}", "true", "v4", "a.b.c.d", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-8", "{PREVIOUS}", "true", "v4", "256.1.1.1", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-9", "{PREVIOUS}", "true", "v4", "1.2.3.4.5", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-10", "{PREVIOUS}", "true", "v4", "127.0.0.1", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-11-data-row-11", "{PREVIOUS}", "true", "v5", "208.77.190.197", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-11-data-row-12", "{\"ns3.epp-11.rst.\" & RANDCHARS(18) & \".\" & $TLD}", "true", "v6", "2602:800:900e:1257::5", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-11-data-row-13", "{\"ns3.epp-11.rst.\" & RANDCHARS(18) & \".\" & $TLD}", "true", "v6", "{EMPTY}", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-11-data-row-14", "{PREVIOUS}", "true", "v6", "208.77.190.198", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-11-data-row-15", "{PREVIOUS}", "true", "v6", "::", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-11-data-row-16", "{PREVIOUS}", "true", "v6", "::1", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-11-data-row-17", "{PREVIOUS}", "true", "v6", "::X", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-11-data-row-18", "{PREVIOUS}", "true", "v6", "NOT::HEX::", "fail", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ] ] }, "epp-13-addr-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "IP Version", "Name" : "ip", "Type" : "string" }, { "Description" : "IP Address", "Name" : "addr", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n* Any row containing an \"action\" value of \"add\" and a passOrFail value of \"pass\" should result in an object property being added, which will be validated using an ` command.\r\n* The cell values for rows with action=rem do not occur in previous rows, so the objects should not have those properties, meaning a successful response is an error.", "Rows" : [ [ "epp-13-addr-data-row-0", "add", "v4", "208.77.190.192", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-addr-data-row-1", "add", "v4", "{EMPTY}", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-2", "add", "v4", "2602:800:900e:1257::1", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-3", "add", "v4", "208.77.190", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-4", "add", "v4", "a.b.c.d", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-5", "add", "v4", "256.1.1.1", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-6", "add", "v4", "1.2.3.4.5", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" ], [ "epp-13-addr-data-row-7", "add", "v5", "208.77.190.193", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-addr-data-row-8", "add", "v6", "2602:800:900e:1257::2", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-addr-data-row-9", "add", "v6", "208.77.190.194", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-13-addr-data-row-10", "add", "v6", "::", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-13-addr-data-row-11", "add", "v6", "::1", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-13-addr-data-row-12", "add", "v6", "::X", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-13-addr-data-row-13", "add", "v6", "NOT::HEX::", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" ], [ "epp-13-addr-data-row-14", "rem", "v4", "208.77.190.195", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-addr-data-row-15", "rem", "v6", "2602:800:900e:1257::3", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ] ] }, "epp-13-status-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "IP Version", "Name" : "status", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n* Any row containing an \"action\" value of \"add\" and a passOrFail value of \"pass\" should result in an object property being added, which will be validated using an `` command.\r\n* The cell values for rows with action=rem do not occur in previous rows, so the objects should not have those properties, meaning a successful response is an error.", "Rows" : [ [ "epp-13-status-data-row-0", "add", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-status-data-row-1", "rem", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-status-data-row-2", "add", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-status-data-row-3", "add", "clientHold", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-4", "add", "linked", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-5", "add", "ok", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-6", "add", "pendingCreate", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-7", "add", "pendingDelete", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-8", "add", "pendingTransfer", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-9", "add", "pendingUpdate", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-10", "add", "serverDeleteProhibited", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-11", "add", "serverUpdateProhibited", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-12", "add", "invalidStatusCode", "fail", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-13-status-data-row-13", "rem", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-13-status-data-row-14", "rem", "clientHold", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-15", "rem", "clientHold", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-16", "rem", "linked", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-17", "rem", "ok", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-18", "rem", "pendingCreate", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-19", "rem", "pendingDelete", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-20", "rem", "pendingTransfer", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-21", "rem", "pendingUpdate", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-22", "rem", "serverDeleteProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-23", "rem", "serverUpdateProhibited", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-13-status-data-row-24", "rem", "invalidStatusCode", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ] ] }, "epp-14-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "name", "Type" : "string" }, { "Description" : "Registration period", "Name" : "period", "Type" : "integer" }, { "Description" : "Registration period units", "Name" : "periodUnit", "Type" : "string" }, { "Description" : "Server data model (row will be skipped if it the value does not match the general.registryDataModel input parameter or either the epp.clid01DataModel or epp.clid02DataModel input parameters", "Name" : "dataModel", "Type" : "string" }, { "Description" : "Registrant ID (if applicable)", "Name" : "registrant", "Type" : "string" }, { "Description" : "Host model (row will be skipped if the value does not match the epp.hostModel input parameter)", "Name" : "hostModel", "Type" : "string" }, { "Description" : "Nameserver name (object will be created if needed)", "Name" : "ns1", "Type" : "string" }, { "Description" : "IPv4 address (if host attributes)", "Name" : "ns1ipv4", "Type" : "string" }, { "Description" : "IPv6 address (if host attributes)", "Name" : "ns1ipv6", "Type" : "string" }, { "Description" : "Nameserver name (object will be created if needed)", "Name" : "ns2", "Type" : "string" }, { "Description" : "IPv4 address (if host attributes)", "Name" : "ns2ipv4", "Type" : "string" }, { "Description" : "IPv6 address (if host attributes)", "Name" : "ns2ipv6", "Type" : "string" }, { "Description" : "Data interface (see RFC 5910, row will be skipped if the value does not match the epp.secDNSInterfaces input parameter)", "Name" : "secDNSInterface", "Type" : "string" }, { "Description" : "DS record Key Tag (if applicable)", "Name" : "keyTag", "Type" : "integer" }, { "Description" : "DS record algorithm (if applicable)", "Name" : "dsDataAlg", "Type" : "integer" }, { "Description" : "DS record digest type (if applicable)", "Name" : "digestType", "Type" : "integer" }, { "Description" : "DS record digest (if applicable)", "Name" : "digest", "Type" : "string" }, { "Description" : "DNSKEY record flags (if applicable)", "Name" : "flags", "Type" : "integer" }, { "Description" : "DNSKEY record protocol (if applicable)", "Name" : "protocol", "Type" : "integer" }, { "Description" : "DNSKEY record algorithm (if applicable)", "Name" : "keyDataAlg", "Type" : "integer" }, { "Description" : "DNSKEY record public key (if applicable)", "Name" : "pubKey", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * `RANDCHARS(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9` (or the `eppSafeCodePoints` property of a corresponding IDN table, if the TLD's `idnOnly` property is true).\r\n * `RANDASCII(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9`, irrespective of the value of the TLD's `idnOnly` property.\r\n * `&` indicates concatenation.\r\n * `$PREFIX` will be `rst-epp-14-` except when value of the TLD's `idnOnly` property is `true`, in which case it will be empty.\r\n* An EPP command passes if the `code` attribute of the `` element in the response is less than or equal to 1999.\r\n* If the EPP server implements RFC 9154, then the `pw` field must be empty.", "Rows" : [ [ "epp-14-data-row-0", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-14-data-row-1", "{$PREFIX & RANDCHARS(64) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DOMAIN_NAME" ], [ "epp-14-data-row-2", "{\"xn--\" & RANDASCII(59) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DOMAIN_NAME" ], [ "epp-14-data-row-3", "{\"xx--\" & RANDASCII(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DOMAIN_NAME" ], [ "epp-14-data-row-4", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "10", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-14-data-row-5", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "11", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD" ], [ "epp-14-data-row-6", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "-1", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD" ], [ "epp-14-data-row-7", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1.5", "y", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD" ], [ "epp-14-data-row-8", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "x", "any", "{AUTO}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD" ], [ "epp-14-data-row-9", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "maximum", "{RANDCHARS(16)}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NON_EXISTENT_REGISTRANT" ], [ "epp-14-data-row-10", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "maximum", "{EMPTY}", "either", "ns1.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_MISSING_REGISTRANT" ], [ "epp-14-data-row-11", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE" ], [ "epp-14-data-row-12", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "208.77.190.199", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-14-data-row-13", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "2602:800:900e:1257::6", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-14", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "208.77.190", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-15", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "a.b.c.d", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-16", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "256.1.1.1", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-17", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "1.2.3.4.5", "{EMPTY}", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-18", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "2602:800:900e:1257::7", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-14-data-row-19", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "208.77.190.200", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-20", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-21", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "::1", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-22", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "::X", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-23", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{\"ns1.\" & $name}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "either", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" ], [ "epp-14-data-row-24", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{EMPTY}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-25", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "{EMPTY}", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-26", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "-1", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-27", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "A", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-28", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "123", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-29", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "16", "{EMPTY}", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-30", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "16", "-1", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-31", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "16", "A", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-32", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "16", "255", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-33", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "dsData", "{AUTO}", "16", "2", "{EMPTY}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-34", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "{EMPTY}", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-35", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "1", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-36", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "256", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-37", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "-1", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-38", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "A", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-39", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "{EMPTY}", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-40", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "1", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-41", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "256", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-42", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "-1", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-43", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "A", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-44", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "{EMPTY}", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-45", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "-1", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-46", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "A", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-47", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "123", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-48", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "{EMPTY}", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-14-data-row-49", "{$PREFIX & RANDCHARS(18) & \".\" & $TLD}", "1", "y", "any", "{AUTO}", "attributes", "{EMPTY}", "{EMPTY}", "NOT::HEX::", "ns2.epp-14.rst.icann", "{EMPTY}", "{EMPTY}", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "this is not a DNSKEY.", "fail", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ] ] }, "epp-16-dnssec-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "Data interface (see RFC 5910, row will be skipped if the value does not match the epp.secDNSInterfaces input parameter)", "Name" : "secDNSInterface", "Type" : "string" }, { "Description" : "DS record Key Tag (if applicable)", "Name" : "keyTag", "Type" : "integer" }, { "Description" : "DS record algorithm (if applicable)", "Name" : "dsDataAlg", "Type" : "integer" }, { "Description" : "DS record digest type (if applicable)", "Name" : "digestType", "Type" : "integer" }, { "Description" : "DS record digest (if applicable)", "Name" : "digest", "Type" : "string" }, { "Description" : "DNSKEY record flags (if applicable)", "Name" : "flags", "Type" : "integer" }, { "Description" : "DNSKEY record protocol (if applicable)", "Name" : "protocol", "Type" : "integer" }, { "Description" : "DNSKEY record algorithm (if applicable)", "Name" : "keyDataAlg", "Type" : "integer" }, { "Description" : "DNSKEY record public key (if applicable)", "Name" : "pubKey", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{AUTO}` means a pseudo-random value generated by a faker library that is syntactically correct as per the XML schema in RFC 5733.\r\n * `RANDCHARS(n)` means `n` randomly-chosen characters from the set `A-Z, a-z, 0-9`.\r\n * `&` indicates concatenation.\r\n * A value of `{PREVIOUS}` indicates that the value computed from the same column in the preceding row should be used.\r\n* An EPP command passes if the `code` attribute of the `` element in the response is less than or equal to 1999.\r\n* If the EPP server implements RFC 9154, then the `pw` field must be empty.", "Rows" : [ [ "epp-16-dnssec-data-row-0", "add", "dsData", "{EMPTY}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-1", "add", "dsData", "{AUTO}", "{EMPTY}", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-2", "add", "dsData", "{AUTO}", "-1", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-3", "add", "dsData", "{AUTO}", "A", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-4", "add", "dsData", "{AUTO}", "123", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-5", "add", "dsData", "{AUTO}", "16", "{EMPTY}", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-6", "add", "dsData", "{AUTO}", "16", "-1", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-7", "add", "dsData", "{AUTO}", "16", "A", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-8", "add", "dsData", "{AUTO}", "16", "255", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-9", "add", "dsData", "{AUTO}", "16", "2", "{EMPTY}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-10", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "{EMPTY}", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-11", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "1", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-12", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "256", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-13", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "-1", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-14", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "A", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-15", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "{EMPTY}", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-16", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "1", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-17", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "256", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-18", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "-1", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-19", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "A", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-20", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "{EMPTY}", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-21", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "-1", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-22", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "A", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-23", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "123", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-24", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-25", "add", "keyData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "this is not a DNSKEY.", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" ], [ "epp-16-dnssec-data-row-26", "add", "dsData", "{AUTO}", "16", "2", "{RANDHEX(32)}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-dnssec-data-row-27", "rem", "dsData", "{PREVIOUS}", "16", "2", "{PREVIOUS}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-dnssec-data-row-28", "rem", "dsData", "{PREVIOUS}", "16", "2", "{PREVIOUS}", "257", "3", "16", "7JCMl8WwNOyFNWF6GBuMlIdtf08Cr1bO/hToZ6xCvKcu4o5ShXBzbCgzTGJHovhoUgj9wsMA1aWA", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-dnssec-data-row-29", "rem", "keyData", "{AUTO}", "13", "2", "{RANDHEX(32)}", "257", "3", "13", "uugEQOG7/3zv3rVGq43NQTqfmZxWn4fMIpi6ph7JKEvTRwhtw3aIV4dSk+fgpFFmORrKNznT7AIuJKy6P/Mi1Q==", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ] ] }, "epp-16-ns-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : "Host model (row will be skipped if the value does not match the epp.hostModel input parameter)", "Name" : "hostModel", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "If a host object (if applicable) should be created", "Name" : "createIfNeeded", "Type" : "boolean" }, { "Description" : "Host name", "Name" : "hostname", "Type" : "string" }, { "Description" : "IP address type (if any)", "Name" : "ipType", "Type" : "string" }, { "Description" : "IP address to add (if any)", "Name" : "ip", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{PREVIOUS}` indicates that the value computed from the same column in the preceding row should be used.\r\n* Any row containing an \"action\" value of \"add\" and a passOrFail value of \"pass\" should result in an object property being added, which will be validated using an `` command.\r\n* The cell values for rows with action=rem do not occur in previous rows, so the objects should not have those properties, meaning a successful response is an error.", "Rows" : [ [ "epp-16-ns-data-row-0", "objects", "add", "false", "{\"ns1.epp-16.rst.\" & RANDCHARS(18) & \".icann\"}", "{EMPTY}", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_NON_EXISTENT_HOST_OBJECT" ], [ "epp-16-ns-data-row-1", "objects", "add", "true", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-2", "objects", "add", "true", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-ns-data-row-3", "objects", "rem", "false", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-4", "objects", "rem", "false", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-ns-data-row-5", "attributes", "add", "{EMPTY}", "{\"ns1.epp-16.rst.\" & RANDCHARS(18) & \".icann\"}", "{EMPTY}", "{EMPTY}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-6", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-ns-data-row-7", "attributes", "rem", "{EMPTY}", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-8", "attributes", "rem", "{EMPTY}", "{PREVIOUS}", "{EMPTY}", "{EMPTY}", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-ns-data-row-9", "attributes", "add", "{EMPTY}", "{\"ns2.epp-16.rst.\" & $DOMAIN}", "{EMPTY}", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-10", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "208.77.190.196", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-11", "attributes", "add", "{EMPTY}", "{\"ns3.epp-16.rst.\" & $DOMAIN}", "{EMPTY}", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE" ], [ "epp-16-ns-data-row-12", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-13", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "2602:800:900e:1257::4", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-14", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "208.77.190", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-15", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "a.b.c.d", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-16", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "256.1.1.1", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-17", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "1.2.3.4.5", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-18", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v4", "127.0.0.1", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-19", "attributes", "add", "{EMPTY}", "{\"ns4.epp-16.rst.\" & $DOMAIN}", "v5", "208.77.190.197", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-20", "attributes", "add", "{EMPTY}", "{\"ns5.epp-16.rst.\" & $DOMAIN}", "v6", "2602:800:900e:1257::5", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-ns-data-row-21", "attributes", "add", "{EMPTY}", "{\"ns6.epp-16.rst.\" & $DOMAIN}", "v6", "{EMPTY}", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-22", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v6", "208.77.190.198", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-23", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v6", "::", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-24", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v6", "::1", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-25", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v6", "::X", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ], [ "epp-16-ns-data-row-26", "attributes", "add", "{EMPTY}", "{PREVIOUS}", "v6", "NOT::HEX::", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" ] ] }, "epp-16-status-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : null, "Name" : "action", "Type" : "string" }, { "Description" : "Status Code", "Name" : "status", "Type" : "string" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n* Any row containing an \"action\" value of \"add\" and a passOrFail value of \"pass\" should result in an object property being added, which will be validated using an `` command.\r\n* The cell values for rows with action=rem do not occur in previous rows, so the objects should not have those properties, meaning a successful response is an error.", "Rows" : [ [ "epp-16-status-data-row-0", "add", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-1", "add", "clientHold", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-2", "add", "clientRenewProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-3", "add", "clientTransferProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-4", "add", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-5", "add", "clientHold", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ], [ "epp-16-status-data-row-6", "rem", "clientUpdateProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-7", "add", "linked", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-8", "add", "ok", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-9", "add", "pendingCreate", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-10", "add", "pendingDelete", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-11", "add", "pendingTransfer", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-12", "add", "pendingUpdate", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-13", "add", "serverDeleteProhibited", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-14", "add", "serverRenewProhibited", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-15", "add", "serverTransferProhibited", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-16", "add", "serverUpdateProhibited", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-17", "add", "invalidStatusCode", "fail", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" ], [ "epp-16-status-data-row-18", "rem", "clientDeleteProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-19", "rem", "clientHold", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-20", "rem", "clientRenewProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-21", "rem", "clientTransferProhibited", "pass", "EPP_UNEXPECTED_COMMAND_FAILURE" ], [ "epp-16-status-data-row-22", "rem", "invalidStatusCode", "fail", "EPP_UNEXPECTED_COMMAND_SUCCESS" ] ] }, "epp-23-data" : { "Columns" : [ { "Description" : "Unique ID for this row", "Name" : "RowID", "Type" : "string" }, { "Description" : "The new hostname for the object", "Name" : "name", "Type" : "string" }, { "Description" : "Whether the superordinate domain name should be created before the subordinate host name is created (if it does not already exist)", "Name" : "createParentFirst", "Type" : "boolean" }, { "Description" : "Expected result", "Name" : "passOrFail", "Type" : "string" }, { "Description" : "Error code if expected result is not produced", "Name" : "errorCode", "Type" : "string" } ], "Description" : "* Values in {parentheses} are not literal values, they indicate that an appropriate value should be computed.\r\n * A value of `{EMPTY}` indicates an empty string.\r\n * A value of `{PREVIOUS}` indicates that the value computed from the same column in the preceding row should be used.\r\n", "Rows" : [ [ "epp-23-data-row-0", "!.invalid", "false", "fail", "EPP_HOST_RENAME_SERVER_ACCEPTS_INVALID_HOSTNAME" ], [ "epp-23-data-row-1", "{\"ns1.epp-23.rst.\" & RANDCHARS(18) & \".icann\"}", "false", "pass", "EPP_HOST_RENAME_SERVER_REJECTS_EXTERNAL_NAME" ], [ "epp-23-data-row-2", "{\"ns1.epp-23.rst.\" & RANDCHARS(18) & \".\" & $RESERVEDNAME}", "false", "fail", "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_ANOTHER_REGISTRARS_DOMAIN" ], [ "epp-23-data-row-3", "{\"ns1.epp-23.rst.\" & RANDCHARS(18) & \".\" & $TLD}", "false", "fail", "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_NONEXISTENT_DOMAIN" ], [ "epp-23-data-row-4", "{PREVIOUS}", "true", "pass", "EPP_HOST_RENAME_SERVER_UNEXPECTEDLY_REJECTS_RENAME" ] ] } }, "Errors" : { "DNSSEC_DNS_QUERY_ERROR" : { "Description" : "An error occurred while performing DNS query(s).", "Severity" : "ERROR" }, "DNSSEC_INVALID_DIGEST_ALGORITHM" : { "Description" : "An invalid algorithm is used in the provided DS record(s).", "Severity" : "ERROR" }, "DNSSEC_INVALID_SIGNING_ALGORITHM" : { "Description" : "An invalid algorithm is used to sign the zone.", "Severity" : "ERROR" }, "DNSSEC_NSEC3_ITERATIONS_IS_NOT_ZERO" : { "Description" : "The `iterations` field of the `NSEC3PARAM` record is not zero.", "Severity" : "ERROR" }, "DNSSEC_NSEC3_SALT_IS_NOT_EMPTY" : { "Description" : "The `salt` field of the `NSEC3PARAM` record is not zero (represented as a\n`-` in the presentation format).\n", "Severity" : "ERROR" }, "DNSSEC_OPS_ALGORITHM_ROLLOVER_CHAIN_OF_TRUST_BROKEN" : { "Description" : "The Chain-of-Trust from the root trust anchor was broken during the\nalgorith rollover.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_ALGORITHM_ROLLOVER_NOT_COMPLETED" : { "Description" : "The algorith rollover was not completed within the test period.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_DNS_QUERY_FAILED_TOO_MANY_TIMES" : { "Description" : "There was an error performing a DNS query.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_INVALID_ALGORITHM" : { "Description" : "The zone was rolled to an invalid algorithm. Please see the details of\n[dnssec-91](#Test-case-dnssec-91) for more information.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_KSK_ROLLOVER_CHAIN_OF_TRUST_BROKEN" : { "Description" : "The Chain-of-Trust from the root trust anchor was broken during the\nKSK rollover.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_KSK_ROLLOVER_NOT_COMPLETED" : { "Description" : "The KSK rollover was not completed within the test period.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_XFR_FAILED_TOO_MANY_TIMES" : { "Description" : "There was an error performing a zone transfer.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_ZONE_IS_INVALID" : { "Description" : "The zone file returned by a zone transfer request was invalid. This may be\nbecause:\n 1. it was not properly signed, or\n 2. it contained an insufficient number of resource records.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_ZSK_ROLLOVER_CHAIN_OF_TRUST_BROKEN" : { "Description" : "The Chain-of-Trust from the root trust anchor was broken during the\nZSK rollover.\n", "Severity" : "ERROR" }, "DNSSEC_OPS_ZSK_ROLLOVER_NOT_COMPLETED" : { "Description" : "The ZSK rollover was not completed within the test period.\n", "Severity" : "ERROR" }, "DNS_CONSISTENCY_QUERY_FAILED" : { "Description" : "One or more responses to DNS queries sent to the subject DNS servers failed.\n", "Severity" : "ERROR" }, "DNS_IDNA2008_INVALID_MNAME" : { "Description" : "The `mname` field of the `SOA` record contains one or more labels that are\nnot compliant with IDNA2008.\n", "Severity" : "ERROR" }, "DNS_IDNA2008_INVALID_NS_NSDNAME" : { "Description" : "One or more `NS` records at the zone apex contains one or more labels that\nare not compliant with IDNA2008.\n", "Severity" : "ERROR" }, "DNS_IDNA2008_INVALID_RNAME" : { "Description" : "The `rname` field of the `SOA` record contains one or more labels that are\nnot compliant with IDNA2008.\n", "Severity" : "ERROR" }, "DNS_IDNA2008_QUERY_FAILED" : { "Description" : "The `SOA` query failed.\n", "Severity" : "CRITICAL" }, "DNS_INCONSISTENT_RESPONSES" : { "Description" : "One or more responses to DNS queries sent to the subject DNS servers were\nnot consistent across all vantage points.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CHECK_INVALID_CONTACT_ID_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CHECK_REGISTERED_CONTACT_ID_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CHECK_VALID_CONTACT_ID_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CC" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CITY" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_EMAIL" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX_EXT" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing `ext`\nattribute of the `` element.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ID" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_NAME" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ORG" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_PC" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_POSTALINFO_TYPE" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained a `` element with an\nincorrect or missing `type` attribute.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_SP" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STREET" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE_EXT" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing `ext`\nattribute of the `` element.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_INFO_RESPONSE_NOT_1000" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object did not result in a response with the `1000`\nresult code.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CC" : { "Description" : "The server incorrectly accepted an empty value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CITY" : { "Description" : "The server incorrectly accepted an empty value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_EMAIL" : { "Description" : "The server incorrectly accepted an empty value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_FAX" : { "Description" : "The server incorrectly accepted an empty value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_NAME" : { "Description" : "The server incorrectly accepted an empty value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_VOICE" : { "Description" : "The server incorrectly accepted an empty value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CC" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CITY" : { "Description" : "The server incorrectly accepted an empty value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ID" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_NAME" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ORG" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" : { "Description" : "The server incorrectly accepted an invalid value for the `type` attribute of\nthe `` element in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_STREET" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_DELETE_OBJECT_STILL_EXISTS" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the deleted object did not result in a response with the `2303`\n(\"Object does not exist\") result code.\n", "Severity" : "ERROR" }, "EPP_CONTACT_DELETE_RESPONSE_NOT_1000_OR_1001" : { "Description" : "The server did not response to a contact `` command with a `1xxx`\nresult code.\n", "Severity" : "ERROR" }, "EPP_CONTACT_INFO_RESPONSE_NOT_REJECTED" : { "Description" : "The server did not reject contact `` command on a contact\nobject not under the sponsorship of the connected client.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CC" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CITY" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_EMAIL" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX_EXT" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing `ext`\nattribute of the `` element.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ID" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_NAME" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ORG" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_PC" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_POSTALINFO_TYPE" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained a `` element with an\nincorrect or missing value for the `type` attribute.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_SP" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STATUS" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained a `` element with an\nincorrect or missing value for the `s` attribute.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STREET" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE_EXT" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing `ext`\nattribute of the `` element.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_INFO_RESPONSE_NOT_1000" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object did not result in a response with the `1000`\nresult code.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_RESPONSE_NOT_REJECTED" : { "Description" : "The server did not reject a contact `` command on a contact\nobject not under the sponsorship of the connected client.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CC" : { "Description" : "The server incorrectly accepted an empty `` element in a\n`` element in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CITY" : { "Description" : "The server incorrectly accepted an empty `` element in a\n`` element in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_NAME" : { "Description" : "The server incorrectly accepted an empty `` element in a\n`` element in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CC" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CITY" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX" : { "Description" : "Following a successful contact `` command, a subsequent ``\nresponse for the created object contained an incorrect or missing ``\nelement.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_ORG" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in\na contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_PC" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE" : { "Description" : "The server incorrectly accepted an invalid value for the `type` attribute of\na `` element in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_SP" : { "Description" : "The server incorrectly accepted an invalid value for the `` element in a\ncontact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" : { "Description" : "The server incorrectly accepted a `` element in element with an\ninvalid `s` attribute in a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STREET" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE" : { "Description" : "The server incorrectly accepted an invalid value for the `` element\nin a contact `` command.\n", "Severity" : "ERROR" }, "EPP_DNS_RESOLUTION_ERROR" : { "Description" : "There was an error while performing a DNS query for the EPP server hostname.\n", "Severity" : "CRITICAL" }, "EPP_DOMAIN_CHECK_INVALID_DOMAIN_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CHECK_REGISTERED_DOMAIN_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CHECK_VALID_DOMAIN_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_INFO_RESPONSE_INVALID_ROID" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object contained an invalid value in the ``\nelement, or which has a suffix not present in the IANA registry.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include one or more elements from\nthe `` command.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_AUTHINFO" : { "Description" : "The server accepts a domain `` command with a `` element with an\ninvalid value.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE" : { "Description" : "The server accepts a domain `` command with one or more ``\nelements containing \"internal\" hostnames, but for which ``\nelements are not provided.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE" : { "Description" : "The server incorrectly accepted an invalid value for the ``\nelement in a `` element in a domain `` command.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" : { "Description" : "The server accepts a domain `` command with one or more ``\nelements containing \"internal\" hostnames, but for which ``\nelements are not provided.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DOMAIN_NAME" : { "Description" : "The server accepts a domain `` command for a syntactically invalid\ndomain name.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_HOST_OBJECT" : { "Description" : "The server accepts a domain `` command which contains a ``\nelement referencing a syntactically invalid hostname.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD" : { "Description" : "The server accepts a domain `` command which contains a ``\nelement with an invalid content and/or `unit` attribute.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_MISSING_REGISTRANT" : { "Description" : "The server accepts a domain `` command which contains an empty\n`` element.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NON_EXISTENT_HOST_OBJECT" : { "Description" : "The server accepts a domain `` command which contains a ``\nelement referencing a non-existent host object.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NON_EXISTENT_REGISTRANT" : { "Description" : "The server accepts a domain `` command which contains a\n`` element referencing a non-existent contact object.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NO_REGISTRANT_FOR_THICK_REGISTRY" : { "Description" : "The server accepts a domain `` command which does not include a\n`` object.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_REGISTRANT_FOR_THIN_REGISTRY" : { "Description" : "The server accepts a domain `` command which includes a\n`` object.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_INCORRECTLY_ACCEPTS_HOST_ATTRIBUTES" : { "Description" : "The server accepts a domain `` command which uses ``\nobjects.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_CREATE_SERVER_INCORRECTLY_ACCEPTS_HOST_OBJECTS" : { "Description" : "The server accepts a domain `` command which uses ``\nobjects.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_DELETE_INFO_RESPONSE_OBJECT_NOT_PENDING_DELETE" : { "Description" : "Following a successful domain `` command, which resulted in a `1001`\nresponse, the domain did not have the `pendingDelete` status.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_DELETE_INFO_RESPONSE_OBJECT_STILL_EXISTS" : { "Description" : "Following a successful domain `` command, which resulted in a `1000`\nresponse, a subsequent `` command did not result in a `2303` (\"Object\ndoes not exist\") result code.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_TRANSFER_REQUEST_FAILED" : { "Description" : "A `` command that should have been successful, did\nnot result in a `1000` or `1001` response code.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_DNSSEC_DATA" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include all expected `` or\n`` elements.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_HOST_ATTRIBUTE" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include all expected ``\nelements.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_HOST_OBJECT" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include all expected ``\nelements.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_REGISTRANT" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include the expected ``\nelement.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_STATUS_CODE" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object did not include the expected ``\nelements.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_DNSSEC_DATA" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object included one or more unexpected ``\nor `` element(s).\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_HOST_ATTRIBUTE" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object included one or more unexpected ``\nelement(s).\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_HOST_OBJECT" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object included one or more unexpected ``\nelement(s).\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_REGISTRANT" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object included an unexpected ``\nelement, or a `` element containinin an unexpected value.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_STATUS_CODE" : { "Description" : "Following a successful domain `` command, a subsequent ``\nresponse for the created object included one or more unexpected ``\nelement(s).\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE" : { "Description" : "The server accepts a domain `` command with one or more ``\nelements containing \"internal\" hostnames, but for which ``\nelements are not provided.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA" : { "Description" : "The server accepts a domain `` command with one or more ``\nor `` elements which contain invalid parameters.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES" : { "Description" : "The server accepts a domain `` command with one or more ``\nelements containing invalid hostnames and/or IP addresses.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" : { "Description" : "The server incorrectly accepted a `` element in element with an\ninvalid `s` attribute in a domain `` command.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_NON_EXISTENT_CONTACT_OBJECT" : { "Description" : "The server accepts a domain `` command which contains a\n`` or `` element containing non-existent contact\nobjects.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_NON_EXISTENT_HOST_OBJECT" : { "Description" : "The server accepts a domain `` command with one or more ``\nelements containing non-existent host objects.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_INCORRECTLY_ACCEPTS_HOST_ATTRIBUTES" : { "Description" : "The server accepts a domain `` command that contained one or more\n`` elements, but the `epp.hostModel` input paramter is `objects`.\n", "Severity" : "ERROR" }, "EPP_DOMAIN_UPDATE_SERVER_INCORRECTLY_ACCEPTS_HOST_OBJECTS" : { "Description" : "The server accepts a domain `` command that contained one or more\n`` elements, but the `epp.hostModel` input paramter is\n`attributes`.\n", "Severity" : "ERROR" }, "EPP_GENERIC_COMMAND_ERROR" : { "Description" : "The client received a 2400 error from the server.", "Severity" : "ERROR" }, "EPP_GREETING_INVALID_LANG" : { "Description" : "The value of one or more of the `` elements in the `` are\ninvalid.\n", "Severity" : "ERROR" }, "EPP_GREETING_MISSING_EN_LANG" : { "Description" : "A `` element with the value `en` was not found in the ``.\n", "Severity" : "ERROR" }, "EPP_GREETING_MISSING_EXTURI" : { "Description" : "A mandatory extension namespace URI is missing.", "Severity" : "ERROR" }, "EPP_GREETING_MISSING_OBJURI" : { "Description" : "A mandatory object namespace URI is missing.", "Severity" : "ERROR" }, "EPP_GREETING_RECOMMENDED_EXTENSION_MISSING" : { "Description" : "The server does not include the namespace URI of a recommended extension\nin an `` element of the `` frame.\n", "Severity" : "WARNING" }, "EPP_GREETING_SVDATE_INVALID" : { "Description" : "The value of the `` element in the `` is invalid.\n", "Severity" : "ERROR" }, "EPP_GREETING_SVID_INVALID" : { "Description" : "The value of the `` element in the `` is invalid.", "Severity" : "ERROR" }, "EPP_GREETING_UNEXPECTED_EXTURI" : { "Description" : "One or more of the `` elements in the `` contain invalid\nnamespace URIs.\n", "Severity" : "ERROR" }, "EPP_GREETING_UNEXPECTED_OBJURI" : { "Description" : "One or more of the `` elements in the `` contain invalid\nnamespace URIs.\n", "Severity" : "ERROR" }, "EPP_GREETING_VERSION_INVALID" : { "Description" : "The value of the `` element in the `` is invalid.\n", "Severity" : "ERROR" }, "EPP_HOST_CHECK_INVALID_HOST_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_HOST_CHECK_REGISTERED_HOST_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_HOST_CHECK_VALID_HOST_INCORRECT_AVAIL" : { "Description" : "The server responded to a `` command with an unexpected value in one\nor more of the `avail` attributes.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_INCORRECT_CLID" : { "Description" : "After successfully creating a host object that is subordinate to a domain\nthat is sponsored by a different client, a subsequent `` command\nshowed that the host object was not sponsored by the sponsor of the\nsuperordinate domain object.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES" : { "Description" : "Following a successful host `` command, a subsequent ``\nresponse for the created object did not include one or more elements from\nthe `` command.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_INFO_RESPONSE_OBJECT_DOES_NOT_EXIST" : { "Description" : "Following a successful host `` command, a subsequent ``\ncommand for the created object returned a `2303` \"Object does not exist\"\nresult code.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_HOSTNAME" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a syntactically invalid hostname.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a syntactically invalid IPv4 address.\n", "Severity" : "ERROR" }, "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a syntactically invalid IPv6 address.\n", "Severity" : "ERROR" }, "EPP_HOST_DELETE_INFO_RESPONSE_OBJECT_STILL_EXISTS" : { "Description" : "Following a successful host `` command, a subsequent ``\ncommand for the created object did not return a `2303` \"Object does not\nexist\" result code.\n", "Severity" : "ERROR" }, "EPP_HOST_DELETE_RESPONSE_NOT_1000_OR_1001" : { "Description" : "The server did not response to a host `` command with a `1xxx`\nresult code.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_OBJECT_NOT_RENAMED" : { "Description" : "Following a successful `` command to rename a host object, a\nsubsequent `` command for the renamed object was not successful.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_ACCEPTS_INVALID_HOSTNAME" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a syntactically invalid hostname.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_ANOTHER_REGISTRARS_DOMAIN" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a hostname that is subordinate to a domain under the sponsorship\nof another registrar.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_NONEXISTENT_DOMAIN" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains a hostname that is subordinate to a non-existent domain.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_INCORRECTLY_ACCEPTS_RENAME" : { "Description" : "In response to an `` command which changes the name of an external\nhost object that has associations with objects that are sponsored by a\ndifferent client, the server does not respond with result code 2305.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_REJECTS_EXTERNAL_NAME" : { "Description" : "The server rejects a host `` command with a `` element that\ncontains an internal hostname.\n", "Severity" : "ERROR" }, "EPP_HOST_RENAME_SERVER_UNEXPECTEDLY_REJECTS_RENAME" : { "Description" : "The server rejects a host `` command with a `` element that it\nshould have accepted.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_AUTHZ_ERROR" : { "Description" : "The server rejects a host `` command for a host object that is not\nunder the sponsorship of the connected client.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES" : { "Description" : "Following a successful host `` command, a subsequent ``\nresponse for the created object did not include one or more elements from\nthe `` command.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_INFO_RESPONSE_OBJECT_DOES_NOT_EXIST" : { "Description" : "Following a successful host `` command, a subsequent ``\ncommand for the created object unexpectedly returned a `2303` \"Object does\nnot exist\" result code.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS" : { "Description" : "The server accepts a host `` command with an `` element that\ncontains a syntactically invalid IPv4 address.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS" : { "Description" : "The server accepts a host `` command with an `` element that\ncontains a syntactically invalid IPv6 address.\n", "Severity" : "ERROR" }, "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE" : { "Description" : "The server accepts a host `` command with a `` element that\ncontains an invalid status code in the `s` attribute.\n", "Severity" : "ERROR" }, "EPP_INTEGRITY_SERVER_ACCEPTS_DELETE_FOR_LINKED_CONTACT_OBJECT" : { "Description" : "The server accepts a `` command for a contact object that has the\n`linked` status.\n", "Severity" : "ERROR" }, "EPP_INTEGRITY_SERVER_ACCEPTS_DELETE_FOR_LINKED_HOST_OBJECT" : { "Description" : "The server accepts a `` command for a host object that has the\n`linked` status.\n", "Severity" : "ERROR" }, "EPP_INVALID_EXTENSION" : { "Description" : "One or more of the extension element(s) provided in an input parameter was\ninvalid. This may be because (a) it was not a well-formed XML instance, (b)\nspecified an extension that was not registered in the EPP Extension Registry\nor (c) could not be validated against the XML schema(s) for that extension.\n", "Severity" : "ERROR" }, "EPP_INVALID_IDN_EXTENSION" : { "Description" : "One or more of the extension element(s) provided in the\n`idn.domainCreateExtension` input parameter was invalid. This may be because\n(a) it was not a well-formed XML instance, (b) specified an extension that\nwas not registered in the EPP Extension Registry or (c) could not be\nvalidated against the XML schema(s) for that extension.\n", "Severity" : "ERROR" }, "EPP_LOGIN_ERROR" : { "Description" : "The client was unable to successfully authenticate with the EPP server.\n", "Severity" : "CRITICAL" }, "EPP_LOGIN_UNEXPECTEDLY_FAILED" : { "Description" : "The client was not able to authenticate with the provided credentials.\n", "Severity" : "ERROR" }, "EPP_LOGIN_UNEXPECTEDLY_SUCCEEDED" : { "Description" : "A `` command that should have failed unexpectedly succeeded.\n", "Severity" : "ERROR" }, "EPP_MISSING_AAAA_RECORDS" : { "Description" : "No `AAAA` record(s) were found for the EPP server hostname.", "Severity" : "WARNING" }, "EPP_MISSING_A_RECORDS" : { "Description" : "No `A` record(s) were found for the EPP server hostname.", "Severity" : "CRITICAL" }, "EPP_NO_GREETING_RECEIVED" : { "Description" : "No `` was received after successful connection.", "Severity" : "ERROR" }, "EPP_NO_SERVICE_PORTS_REACHABLE" : { "Description" : "No service ports could be reached, for either IPv4 or (if supported) IPv6.\n", "Severity" : "CRITICAL" }, "EPP_RENEW_INFO_RESPONSE_MISSING_OR_INVALID_RGP_STATUS" : { "Description" : "Following a successful `` command, a subsequent ``\ncommand for the domain did not include the `renewPeriod` RGP status.\n", "Severity" : "ERROR" }, "EPP_RENEW_INFO_RESPONSE_UNEXPECTED_EXPIRY_DATE" : { "Description" : "Following a successful `` command, a subsequent ``\ncommand for the domain did not include an `` element with the\nexpected expiry date.\n", "Severity" : "ERROR" }, "EPP_RENEW_SERVER_ACCEPTS_INVALID_CURRENT_EXPIRY_DATE" : { "Description" : "The server accepted an EPP `` command with a `` element\nthat contains the incorrect expiry date.\n", "Severity" : "ERROR" }, "EPP_RENEW_SERVER_ACCEPTS_INVALID_PERIOD" : { "Description" : "The server accepted an EPP `` command with a `` element\nthat contains an incorrect value or `unit` attribute.\n", "Severity" : "ERROR" }, "EPP_SCHEMA_VALIDATION_ERROR" : { "Description" : "The response from the server failed schema validation.", "Severity" : "ERROR" }, "EPP_SERVER_ACCEPTS_INTERNAL_HOST_WITH_GLUE" : { "Description" : "The server allowed the client to create a host object that is subordinate to\na domain object sponsored by another client, when glue addresses were\nspecified.\n", "Severity" : "ERROR" }, "EPP_SERVER_ALLOWS_DELEGATION_TO_GLUELESS_HOST" : { "Description" : "The server accepted an `` command which assigned a glueless internal\nhost object to a domain.\n", "Severity" : "ERROR" }, "EPP_SERVICE_PORT_NOT_CONSISTENT" : { "Description" : "One or more `` commands sent to the advertised EPP service ports\nresulted in inconsistent responses.\n", "Severity" : "ERROR" }, "EPP_SERVICE_PORT_UNREACHABLE" : { "Description" : "The client was unable to successfully connect to the EPP server. This is not\na fatal error, but if no service ports are reachable, the test will fail.\n", "Severity" : "WARNING" }, "EPP_TLS_BAD_CIPHER" : { "Description" : "The server uses an encryption cipher not recommended in [RFC\n9325](https://www.rfc-editor.org/rfc/rfc9325.html).\n", "Severity" : "ERROR" }, "EPP_TLS_CERTIFICATE_CHAIN_MISSING" : { "Description" : "One or more intermediate certificates are missing.", "Severity" : "ERROR" }, "EPP_TLS_CERTIFICATE_HOSTNAME_MISMATCH" : { "Description" : "The hostname in the TLS certificate does not match the EPP server hostname.\n", "Severity" : "ERROR" }, "EPP_TLS_CONNECTION_ERROR" : { "Description" : "There was an error during the TLS handshake while connecting to the EPP\nserver.\n", "Severity" : "ERROR" }, "EPP_TLS_EXPIRED_CERTIFICATE" : { "Description" : "The TLS certificate presented by the EPP server has expired.", "Severity" : "ERROR" }, "EPP_TLS_FORBIDDEN_PROTOCOL_SUPPORTED" : { "Description" : "The EPP server implements a forbidden protocol.", "Severity" : "ERROR" }, "EPP_TLS_REQUIRED_PROTOCOL_NOT_SUPPORTED" : { "Description" : "The EPP server does not implement a required protocol.", "Severity" : "ERROR" }, "EPP_TLS_UNTRUSTED_CERTIFICATE" : { "Description" : "The TLS certificate presented by the EPP server is not issued by a trusted\nCertificate Authority.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_INFO_RESPONSE_AUTHINFO_NOT_RESET" : { "Description" : "Following a successful domain transfer, the authInfo of the transferred\ndomain was not changed.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_RGP_STATUS" : { "Description" : "Following a successful domain transfer, a subsequent `` response did\nnot include the expected RGP status (`transferPeriod`).\n", "Severity" : "ERROR" }, "EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_STATUS_CODE" : { "Description" : "Following a successful `` command, a subsequent\n`` response did not include the `pendingTransfer` status.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_INFO_RESPONSE_UNEXPECTED_EXPIRY_DATE" : { "Description" : "Following a successful domain transfer, a subsequent `` response did\nnot include the expected value of the `` element.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_NOT_PROCESSED" : { "Description" : "The server did not process an approved transfer request within the allotted\ntime.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_SERVER_ACCEPTS_INCORRECT_AUTHINFO" : { "Description" : "The server incorrectly accepted a `` command\ncontaining an invalid authInfo code.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_SERVER_ACCEPTS_INSECURE_AUTHINFO" : { "Description" : "An EPP server implementing Secure Authorization Information for Transfer\n([RFC 9154](https://www.rfc-editor.org/rfc/rfc9154.html)) accepted an\n`` command that specified an authInfo code with insufficient\nentropy.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_SERVER_ACCEPTS_INVALID_PERIOD" : { "Description" : "The server incorrectly accepted a `` command\ncontaining a `` element that contains an incorrect value or `unit`\nattribute.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_SERVER_PROCESSED_REJECTED_TRANSFER" : { "Description" : "Following a successful `` command submitted by the\nlosing registrar of a transfer, the domain was still transferred away from\nthat registrar.\n", "Severity" : "ERROR" }, "EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO" : { "Description" : "An EPP server implementing Secure Authorization Information for Transfer\n([RFC 9154](https://www.rfc-editor.org/rfc/rfc9154.html)) rejected an\n`` command that specified an authInfo code with at least as much\nentropy as specified in Section 4.1 of that RFC (that is, 128 bits).\n", "Severity" : "ERROR" }, "EPP_UNEXPECTED_COMMAND_FAILURE" : { "Description" : "A command that should have succeeded return a response with a status code of\n2000 or higher.\n", "Severity" : "ERROR" }, "EPP_UNEXPECTED_COMMAND_SUCCESS" : { "Description" : "A command that should have failed return a response with a status code of\n1999 or lower.\n", "Severity" : "ERROR" }, "EPP_UNEXPECTED_HOST_CREATE_SUCCESS" : { "Description" : "The server incorrectly accepted a `` command for a host object that\nwas subordinate to a domain under the sponsorship of a different client.\n", "Severity" : "ERROR" }, "EPP_XML_PARSE_ERROR" : { "Description" : "The XML response from the server could not be parsed.", "Severity" : "ERROR" }, "IDN_IDNONLY_TLD_ACCEPTS_ASCII_DOMAIN" : { "Description" : "The server incorrectly accepted a `` command for an ASCII domain in\na TLD whose `idnOnly` property is `true`.\n", "Severity" : "ERROR" }, "IDN_SERVER_ACCEPTS_INVALID_LABEL" : { "Description" : "The server accepts a `` command with a `` object containing an\n**invalid** label.\n", "Severity" : "ERROR" }, "IDN_SERVER_REJECTS_VALID_LABEL" : { "Description" : "The server rejects a `` command with a `` object containing a\n**valid** label.\n", "Severity" : "ERROR" }, "IDN_VARIANT_LABEL_NOT_BLOCKED" : { "Description" : "A variant label remains available for registration.\n", "Severity" : "ERROR" }, "IDN_VARIANT_SERVER_ACCEPTS_VARIANT_CREATE_FROM_INCORRECT_REGISTRAR" : { "Description" : "The server accepts a `` command for a variant of an existing domain\nfrom a registrar other than that of the original domain.\n", "Severity" : "ERROR" }, "IDN_VARIANT_SERVER_ACCEPTS_VARIANT_CREATE_WITH_INCORRECT_REGISTRANT" : { "Description" : "The server accepts a `` command for a variant of an existing domain\nfrom with a registrant other than that the original domain.\n", "Severity" : "ERROR" }, "IDN_VARIANT_SERVER_REJECTS_VARIANT_CREATE_FROM_SAME_REGISTRAR" : { "Description" : "The server rejects a `` command for a variant of an existing domain\nfrom the registrar of the original domain.\n", "Severity" : "ERROR" }, "IDN_VARIANT_SERVER_REJECTS_VARIANT_CREATE_WITH_SAME_REGISTRANT" : { "Description" : "The server rejects a `` command for a variant of an existing domain\nusing the same registrant as of the original domain.\n", "Severity" : "ERROR" }, "INTEGRATION_DNS_QUERY_FAILED" : { "Description" : "A DNS query failed. Persistent errors may result in the test failing if the\nexpected resource records are not observed within the Service Level\nRequirement.\n", "Severity" : "WARNING" }, "INTEGRATION_DOMAIN_NOT_PRESENT_IN_DNS" : { "Description" : "One or more expected DNS records were not observed within the Service Level\nRequirement. This may be due to recurrent errors performing DNS queries, or\nbecause the DNS server(s) did not respond with the expected resource\nrecords.\n", "Severity" : "ERROR" }, "INTEGRATION_DOMAIN_NOT_PRESENT_IN_RDAP" : { "Description" : "One or more expected RDAP responses were not observed within the Service\nLevel Requirement. This may be due to recurrent errors performing RDAP\nqueries, or because the RDAP server(s) did not respond with the expected\nresponses.\n", "Severity" : "ERROR" }, "INTEGRATION_DOMAIN_NOT_PRESENT_IN_RDE" : { "Description" : "One or more expected RDE objects were not observed within the Service Level\nRequirement. This may be due to recurrent errors accessing the SFTP server,\nbecause the deposit file(s) could not be found, or because the objects were\nnot present in those files.\n", "Severity" : "ERROR" }, "INTEGRATION_EXPECTED_GLUE_NOT_OBSERVED" : { "Description" : "A/AAAA records for internal nameservers assigned to a domain name were not\nobserved in DNS query responses within 1 hour of being assigned to that\ndomain.\n", "Severity" : "ERROR" }, "INTEGRATION_LINKED_HOST_OBJECTS_NOT_OBSERVED" : { "Description" : "A/AAAA records for internal host objects assigned to a domain name were not\nobserved in DNS query responses within 1 hour of being assigned to that\ndomain.\n", "Severity" : "ERROR" }, "INTEGRATION_RDAP_REQUEST_FAILED" : { "Description" : "An RDAP query failed. Persistent errors may result in the test failing if\nthe expected resource records are not observed within the Service Level\nRequirement.\n", "Severity" : "WARNING" }, "INTEGRATION_RDE_SFTP_SERVER_AUTHENTICATION_ERROR" : { "Description" : "There was an issue authenticating with the SFTP server. Persistent errors\nmay result in the test failing if the expected objects are not observed in a\nvalid deposit within the Service Level Requirement.\n", "Severity" : "WARNING" }, "INTEGRATION_RDE_SFTP_SERVER_UNREACHABLE" : { "Description" : "There was an issue connecting to the SFTP server. Persistent errors may\nresult in the test failing if the expected objects are not observed in a\nvalid deposit within the Service Level Requirement.\n", "Severity" : "WARNING" }, "INTEGRATION_UNEXPECTED_GLUE_OBSERVED" : { "Description" : "A/AAAA records for an internal nameserver that was assigned to a sibling of\nits superordinate domain were observed in DNS query responses.\n", "Severity" : "ERROR" }, "INTEGRATION_UNLINKED_HOST_OBJECTS_OBSERVED" : { "Description" : "A/AAAA records for an unlinked internal host object were observed in DNS\nquery responses.\n", "Severity" : "ERROR" }, "RDAP_DOMAIN_HEAD_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_DOMAIN_RESPONSE_VALIDATION_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_ENTITY_HEAD_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_ENTITY_RESPONSE_VALIDATION_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_HELP_RESPONSE_VALIDATION_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_DOMAIN" : { "Description" : "A query for a non-existent domain did not produce a conformant error\nresponse.\n", "Severity" : "ERROR" }, "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_ENTITY" : { "Description" : "A query for a non-existent entity did not produce a conformant error\nresponse.\n", "Severity" : "ERROR" }, "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_NAMESERVER" : { "Description" : "A query for a non-existent nameserver did not produce a conformant error\nresponse.\n", "Severity" : "ERROR" }, "RDAP_NAMESERVER_HEAD_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_NAMESERVER_RESPONSE_VALIDATION_FAILED" : { "Description" : "The response from the server could not be validated.\n", "Severity" : "ERROR" }, "RDAP_QUERY_FAILED" : { "Description" : "An RDAP query that should have been successful produced an error response or\ncould not be completed.\n", "Severity" : "ERROR" }, "RDAP_SERVICE_PORT_NOT_CONSISTENT" : { "Description" : "The responses received are not consistent across all service ports.\n", "Severity" : "ERROR" }, "RDAP_TLS_BAD_CIPHER" : { "Description" : "One or more RDAP service ports do implement a forbidden encryption cipher\n", "Severity" : "ERROR" }, "RDAP_TLS_CERTIFICATE_CHAIN_MISSING" : { "Description" : "One or more RDAP service ports do not provide the full chain required to\nvalidate the server's certificate.\n", "Severity" : "ERROR" }, "RDAP_TLS_CERTIFICATE_HOSTNAME_MISMATCH" : { "Description" : "One or more RDAP service ports offer a certificate that cannot be matched\nagainst the RDAP server name.\n", "Severity" : "ERROR" }, "RDAP_TLS_DNS_RESOLUTION_ERROR" : { "Description" : "An error occurred during DNS resolution of one of the RDAP base URL(s).\n", "Severity" : "ERROR" }, "RDAP_TLS_EXPIRED_CERTIFICATE" : { "Description" : "One or more RDAP service ports offer a certificate that has expired.\n", "Severity" : "ERROR" }, "RDAP_TLS_FORBIDDEN_PROTOCOL_SUPPORTED" : { "Description" : "One or more RDAP service ports do implement a forbidden version of TLS.\n", "Severity" : "ERROR" }, "RDAP_TLS_NO_SERVICE_PORTS_REACHABLE" : { "Description" : "No service ports could be reached.\n", "Severity" : "CRITICAL" }, "RDAP_TLS_REQUIRED_PROTOCOL_NOT_SUPPORTED" : { "Description" : "One or more RDAP service ports do not implement a required version of TLS.\n", "Severity" : "ERROR" }, "RDAP_TLS_SERVICE_PORT_UNREACHABLE" : { "Description" : "A service port was not reachable. If all service ports are unreachable, then\nthe test case will fail.\n", "Severity" : "ERROR" }, "RDAP_TLS_UNTRUSTED_CERTIFICATE" : { "Description" : "One or more RDAP service ports offer a certificate that was not issued by a\ntrusted certificate authority.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_INVALID_CC" : { "Description" : "One or more contact objects have a `` element which contains a country\ncode that is not present in the ISO-3166-alpha-2 list.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_INVALID_EMAIL" : { "Description" : "One or more contact objects have an `` element whose value does not\ncomply with [RFC 5322](https://www.rfc-editor.org/rfc/rfc5322.html)\n(sections 3.2.3 and 3.4.1).\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_INVALID_ROID" : { "Description" : "One or more contact objects have a `` element with a repository\nidentifier not found in the IANA registry.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_MULTIPLE_POSTALINFO_TYPES" : { "Description" : "One or more contact objects have more than `` element with the\nsame `type` attribute.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_NON_UNIQUE_ID" : { "Description" : "One or more contact objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_NON_UNIQUE_ROID" : { "Description" : "One or more contact objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_UNKNOWN_ACRR" : { "Description" : "One or more contact objects have an `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_UNKNOWN_CLID" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_UNKNOWN_CRRR" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_UNKNOWN_RERR" : { "Description" : "One or more contact objects have an `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_CONTACT_HAS_UNKNOWN_UPRR" : { "Description" : "One or more contact objects have an `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_CONTACT_OBJECT_MISSING" : { "Description" : "At least one contact object should be present in the deposit, but was not\nfound.\n", "Severity" : "ERROR" }, "RDE_DECRYPTION_FAILED" : { "Description" : "The deposit file could not be decrypted.\n", "Severity" : "CRITICAL" }, "RDE_DOMAIN_HAS_INVALID_ACRR" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_CLID" : { "Description" : "One or more domain objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_CRDATE" : { "Description" : "One or more domain objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_CRRR" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_EXDATE" : { "Description" : "One or more domain objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_NAME" : { "Description" : "One or more domain objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_REGISTRANT" : { "Description" : "One or more domain objects have an `` element that is not\npresent in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_RERR" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_ROID" : { "Description" : "One or more domain objects have a `` element with a repository\nidentifier not found in the IANA registry.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_STATUS" : { "Description" : "One or more domain objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_INVALID_UPRR" : { "Description" : "One or more contact objects have a `` element containing a registrar\nID that is not present in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_CLID" : { "Description" : "One or more domain objects have an `` element that is not present in\nthe deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_CONTACT" : { "Description" : "One or more domain objects have a `` element which is not\npresent in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_CRDATE" : { "Description" : "One or more domain objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_EXDATE" : { "Description" : "One or more domain objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_NAMESERVER" : { "Description" : "One or more domain objects have a `` element which is not\npresent in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_REGISTRANT" : { "Description" : "One or more domain objects have a `` element which is not\npresent in the deposit.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_ROID" : { "Description" : "One or more domain objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_MISSING_STATUS" : { "Description" : "One or more domain objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_NON_UNIQUE_NAME" : { "Description" : "One or more domain objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_NON_UNIQUE_ROID" : { "Description" : "One or more domain objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_UNEXPECTED_HOST_ATTRIBUTES" : { "Description" : "One or more domain objects have a `` element, but the value of the\n`epp.hostModel` input parameter is `objects`.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_HAS_UNEXPECTED_HOST_OBJECTS" : { "Description" : "One or more domain objects have a `` element, but the value of the\n`epp.hostModel` input parameter is `attributes`.\n", "Severity" : "ERROR" }, "RDE_DOMAIN_OBJECT_MISSING" : { "Description" : "At least one domain object should be present in the deposit, but was not\nfound.\n", "Severity" : "ERROR" }, "RDE_EPP_PARAMS_MISSING_EXTURI" : { "Description" : "A mandatory extension namespace URI is missing.\n", "Severity" : "ERROR" }, "RDE_EPP_PARAMS_MISSING_OBJURI" : { "Description" : "A mandatory object namespace URI is missing.\n", "Severity" : "ERROR" }, "RDE_EPP_PARAMS_UNEXPECTED_EXTURI" : { "Description" : "One or more of the `` elements in the EPP Parameters object contain\nan invalid namespace URI.\n", "Severity" : "ERROR" }, "RDE_EPP_PARAMS_UNEXPECTED_OBJURI" : { "Description" : "One or more of the `` elements in the EPP Parameters object contain\nan invalid namespace URI.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_INVALID_CLID" : { "Description" : "One or more host objects have an `` element that is not present in the\ndeposit.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_INVALID_IP_ADDRESS" : { "Description" : "One or more host objects have an invalid IP address.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_INVALID_NAME" : { "Description" : "One or more host objects have an invalid hostname.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_INVALID_ROID" : { "Description" : "One or more host objects have a `` element with a repository\nidentifier not found in the IANA registry.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_INVALID_STATUS" : { "Description" : "One or more domain objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_MISSING_CLID" : { "Description" : "One or more host objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_MISSING_IP_ADDRESS" : { "Description" : "One or more host objects with internal hostnames do not have a ``\nelement.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_MISSING_ROID" : { "Description" : "One or more host objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_MISSING_STATUS" : { "Description" : "One or more host objects do not have a `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_NON_UNIQUE_NAME" : { "Description" : "One or more host objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_HAS_NON_UNIQUE_ROID" : { "Description" : "One or more host objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_HOST_OBJECT_MISSING" : { "Description" : "At least one contact object should be present in the deposit, but was not\nfound.\n", "Severity" : "ERROR" }, "RDE_IDN_OBJECT_INVALID" : { "Description" : "The deposit contains one or more invalid IDN objects.\n", "Severity" : "ERROR" }, "RDE_IDN_OBJECT_MISSING" : { "Description" : "One or more IDN objects are missing.\n", "Severity" : "ERROR" }, "RDE_IDN_OBJECT_UNEXPECTED" : { "Description" : "One or more unexpected IDN objects were found in the deposit.\n", "Severity" : "ERROR" }, "RDE_INVALID_CSV" : { "Description" : "One or more CSV files in the deposit do not conform to [RFC\n4180](https://www.rfc-editor.org/rfc/rfc4180.html).\n", "Severity" : "ERROR" }, "RDE_INVALID_FILENAME" : { "Description" : "The filename of the deposit does not confirm to the requirements in\nSpecification 2 of the Registry Agreement.\n", "Severity" : "ERROR" }, "RDE_INVALID_SIGNATURE" : { "Description" : "The OpenPGP signature could not be validated.\n", "Severity" : "ERROR" }, "RDE_MENU_AND_HEADER_URIS_DIFFER" : { "Description" : "The set of URIs in the `` elements in the `` element\ndiffers from the set of URIs in the `uri` attributes of the ``\nelements in the `` element.\n", "Severity" : "ERROR" }, "RDE_MISSING_EPP_PARAMS_OBJECT" : { "Description" : "An EPP Parameters object was not found in the deposit.\n", "Severity" : "ERROR" }, "RDE_MISSING_FILES" : { "Description" : "Following decryption, one or more XML or CSV files that should have been\npresent, were not.\n", "Severity" : "CRITICAL" }, "RDE_MISSING_OBJECT_URI" : { "Description" : "One or more expected object URIs were not found in the header.\n", "Severity" : "ERROR" }, "RDE_MULTIPLE_EPP_PARAMS_OBJECTS" : { "Description" : "The deposit contained more than one EPP Parameters object.\n", "Severity" : "ERROR" }, "RDE_NNDN_CONFLICTS_WITH_DOMAIN" : { "Description" : "One or more NNDN objects have names that match those of one or more domain\nobjects.\n", "Severity" : "ERROR" }, "RDE_NNDN_HAS_NON_UNIQUE_NAME" : { "Description" : "One or more NNDN objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_OBJECT_COUNT_MISMATCH" : { "Description" : "The number of objects in the deposit does not match the counts found in the\nheader.\n", "Severity" : "ERROR" }, "RDE_OBJECT_HAS_MIXED_TYPES" : { "Description" : "The deposit contains an object that is escrowed in both XML and CSV formats.\n", "Severity" : "ERROR" }, "RDE_POLICY_OBJECT_INVALID" : { "Description" : "The Policy Object is invalid.\n", "Severity" : "ERROR" }, "RDE_POLICY_OBJECT_MISSING" : { "Description" : "The Policy Object is missing.\n", "Severity" : "ERROR" }, "RDE_POLICY_OBJECT_MISSING_OBJECTS" : { "Description" : "The Policy Object does not contain all expected objects.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_INVALID_GURID" : { "Description" : "One of more registrar objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_INVALID_ID" : { "Description" : "One of more registrar objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_INVALID_NAME" : { "Description" : "One of more registrar objects have an invalid `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_MISSING_GURID" : { "Description" : "One of more registrar objects have a missing `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_MISSING_ID" : { "Description" : "One of more registrar objects have a missing `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_MISSING_NAME" : { "Description" : "One of more registrar objects have a missing `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_HAS_NON_UNIQUE_ID" : { "Description" : "One or more registrar objects have the same `` element.\n", "Severity" : "ERROR" }, "RDE_REGISTRAR_OBJECT_MISSING" : { "Description" : "At least one registrar object should be present in the deposit, but was not\nfound.\n", "Severity" : "ERROR" }, "RDE_SCHEMA_VALIDATION_ERROR" : { "Description" : "The XML in the deposit file could not be validated against the schema.\n", "Severity" : "CRITICAL" }, "RDE_UNEXPECTED_OBJECT" : { "Description" : "The deposit contained an object with a namespace URI that was not listed in\nthe `` or `
` elements of the deposit.\n", "Severity" : "ERROR" }, "RDE_UNEXPECTED_OBJECT_URI" : { "Description" : "The deposit contains an unexpected object URI in the header.\n", "Severity" : "ERROR" }, "RDE_XML_PARSE_ERROR" : { "Description" : "The XML in the deposit file is not well-formed.\n", "Severity" : "CRITICAL" }, "RPMS_INVALID_CLAIMS_KEY" : { "Description" : "The `` response included a `` element with an\ninvalid value.\n", "Severity" : "ERROR" }, "RPMS_MISSING_CLAIMS_KEY" : { "Description" : "The `` response did not include an expected ``\nelement.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_INFO_OBJECT_DOES_NOT_EXIST" : { "Description" : "Following a sunrise `` command, the `` response did not return\nthe created object.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_INFO_OBJECT_IS_HAS_MISSING_OR_INVALID_PROPERTIES" : { "Description" : "Following a sunrise `` command, the `` response contained\nmissing or invalid object properties.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_UNEXPECTED_FAILURE_USING_VALID_SMD" : { "Description" : "A sunrise `` command using a **valid** SMD unexpectedly failed.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INCORRECT_SMD" : { "Description" : "A sunrise `` command using an SMD that did not contain the domain unexpectedly succeeded.", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_SMD" : { "Description" : "A sunrise `` command using an **invalid** SMD unexpectedly\nsucceeded.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_REVOKED_SMD" : { "Description" : "A sunrise `` command using a **revoked** SMD unexpectedly succeeded.\n", "Severity" : "ERROR" }, "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_SMD_WITH_REVOKED_SIGNATURE" : { "Description" : "A sunrise `` command using an SMD signed with a revoked certificate\nunexpectedly succeeded.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_INFO_OBJECT_DOES_NOT_EXIST" : { "Description" : "Following a trademark claims `` command, the `` response did\nnot return the created object.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_INFO_OBJECT_IS_HAS_MISSING_OR_INVALID_PROPERTIES" : { "Description" : "Following a trademark claims `` command, the `` response\ncontained missing or invalid object properties.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_UNEXPECTED_FAILURE_USING_VALID_NOTICE_ID" : { "Description" : "A trademark claims `` command using a **valid** notice ID\nunexpectedly failed.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_EXPIRED_NOTICE_ID" : { "Description" : "A trademark claims `` command using an **expired** notice ID\nunexpectedly succeeded.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_ACCEPTANCE_DATE" : { "Description" : "A trademark claims `` command using an **invalid** acceptance date\nunexpectedly succeeded.\n", "Severity" : "ERROR" }, "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_NOTICE_ID" : { "Description" : "A trademark claims `` command using an **invalid** notice ID\nunexpectedly succeeded.\n", "Severity" : "ERROR" }, "RPMS_UNEXPECTED_CLAIMS_KEY" : { "Description" : "The `` response included an unexpected `` element.\n", "Severity" : "ERROR" }, "RST_EXCEPTION" : { "Description" : "This error occurs when an exception occurs in the RST test system that\ncannot be recovered. This issue is with RST system, not the target\nregistry system. If this error occurs, then the test run will have a\n`result` property of `exception`.\n\nThis error may occur in any test case.\n", "Severity" : "CRITICAL" }, "RST_REMOVED_ERROR" : { "Description" : "A condition occurred that triggered an error which was subsequently\nremoved from the test specification.\n\nThis error may occur in any test case.\n", "Severity" : "ERROR" }, "SRSGW_CONTACT_CREATE_FAILED" : { "Description" : "The contact `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_CONTACT_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES" : { "Description" : "Following a successful contact `` command, the `` response\nfrom the SRS Gateway EPP server has missing or invalid object properties.\n", "Severity" : "ERROR" }, "SRSGW_CONTACT_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE" : { "Description" : "Following a successful contact `` command, the primary EPP server\ndid not respond with a successful `` response within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_CREATE_FAILED" : { "Description" : "The domain `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES" : { "Description" : "Following a successful domain `` command, the `` response\nfrom the SRS Gateway EPP server has missing or invalid object properties.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE" : { "Description" : "Following a successful domain `` command, the primary EPP server\ndid not respond with a successful `` response within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_DELETE_DOMAIN_NOT_PENDINGDELETE" : { "Description" : "Following a successful domain `` command, the domain did not have\nthe `pendingDelete` status at the primary EPP server.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_DELETE_FAILED" : { "Description" : "The domain `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_DELETE_RGP_STATUS_NOT_REDEMPTIONPERIOD" : { "Description" : "Following a successful domain `` command, the domain did not have\nthe `redemptionPeriod` RGP status at the primary EPP server.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_RENEW_FAILED" : { "Description" : "The domain `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_RENEW_INCORRECT_EXPIRY_DATE" : { "Description" : "Following a successful `` command, the response to an ``\ncommand for the domain on the Primary EPP server contained an incorrect\nvalue in the `` element.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_RENEW_OBJECT_NOT_UPDATED_WITHIN_DEADLINE" : { "Description" : "Following a successful `` command, the domain's expiry date was not\nupdated at the primary EPP server within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_APPROVAL_FAILED" : { "Description" : "The domain `` command at the SRS Gateway EPP server\nfailed.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_HAS_INCORRECT_CLID" : { "Description" : "Following a successful `` command, the domain is\nunder the sponsorship of the wrong registrar.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_NOT_UPDATED_WITHIN_DEADLINE" : { "Description" : "Following a successful `` command at the SRS Gateway,\nthe domain's sponsor was not updated at the primary EPP server within the\ndeadline.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_STILL_PENDING_TRANSFER" : { "Description" : "The domain `` command at the SRS Gateway, the\ndomain's still has the `pendingTransfer` status.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_REQUEST_FAILED" : { "Description" : "The domain `` command at the SRS Gateway EPP server\nfailed.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_REQUEST_OBJECT_NOT_PENDING_TRANSFER" : { "Description" : "Following a successful `` command at the SRS Gateway,\nwhich resulted in a `1001` response, the domain does not have the\n`pendingTransfer` status.\n", "Severity" : "ERROR" }, "SRSGW_DOMAIN_TRANSFER_REQUEST_OBJECT_NOT_UPDATED_WITHIN_DEADLINE" : { "Description" : "Following a successful `` command at the SRS Gateway,\nwhich resulted in a `1000` response, the domain's sponsor was not updated at\nthe primary EPP server within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_EPP_CONTACT_DELETE_FAILED" : { "Description" : "The contact `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_EPP_CONTACT_DELETE_OBJECT_STILL_EXISTS" : { "Description" : "Following a successful contact `` command, the object was not purged\nfrom the primary EPP server within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_EPP_CONTACT_UPDATE_FAILED" : { "Description" : "The contact `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_EPP_CONTACT_UPDATE_INFO_RESPONSES_DIFFER" : { "Description" : "Following a successful contact `` command, the `` response\nfrom the primary EPP server was not updated within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_EPP_HOST_DELETE_FAILED" : { "Description" : "The host `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_EPP_HOST_DELETE_OBJECT_STILL_EXISTS" : { "Description" : "Following a successful host `` command, the object was not purged\nfrom the primary EPP server within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_EPP_HOST_UPDATE_FAILED" : { "Description" : "The host `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_EPP_HOST_UPDATE_INFO_RESPONSES_DIFFER" : { "Description" : "Following a successful host `` command, the `` response from\nthe primary EPP server was not updated within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_EPP_INVALID_EXTENSION" : { "Description" : "The XML instance provided in the `srsgw.loginExtension`,\n`srsgw.domainCreateExtension`, `srsgw.domainDeleteExtension`,\n`srsgw.domainRenewExtension`, `srsgw.domainTransferRequestExtension` or\n`srsgw.domainTransferApproveExtension` input parameters was invalid. This\nmay be because (a) it was not a well-formed XML instance, (b) specified an\nextension that was not registered in the EPP Extension Registry or (c)\ncould not be validated against the XML schema(s) for that extension.\n", "Severity" : "ERROR" }, "SRSGW_HOST_CREATE_FAILED" : { "Description" : "The host `` command at the SRS Gateway EPP server failed.\n", "Severity" : "ERROR" }, "SRSGW_HOST_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES" : { "Description" : "Following a successful host `` command, the `` response\nfrom the SRS Gateway EPP server has missing or invalid object properties.\n", "Severity" : "ERROR" }, "SRSGW_HOST_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE" : { "Description" : "Following a successful host `` command, the primary EPP server\ndid not respond with a successful `` response within the deadline.\n", "Severity" : "ERROR" }, "SRSGW_RDAP_DNS_RESOLUTION_ERROR" : { "Description" : "None of the RDAP base URL(s) could be resolved.\n", "Severity" : "ERROR" }, "SRSGW_RDAP_QUERY_FAILED" : { "Description" : "The RDAP query resulted in an unexpected response (HTTP status, media type,\netc).\n", "Severity" : "ERROR" }, "SRSGW_RDAP_RESPONSES_DIFFER" : { "Description" : "The responses from the SRS Gateway and Primary RDAP servers differ.\n", "Severity" : "ERROR" }, "SRSGW_RDAP_SERVICE_PORT_UNREACHABLE" : { "Description" : "None of the RDAP service ports could be reached.\n", "Severity" : "ERROR" }, "SRSGW_RDAP_TLS_CONNECTION_ERROR" : { "Description" : "A TLS connection could not be established to the service port.\n", "Severity" : "ERROR" }, "ZM_A01_ADDR_NOT_GLOBALLY_REACHABLE" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP address(es) not listed as globally reachable: \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#:~:text=A01_ADDR_NOT_GLOBALLY_REACHABLE).", "Severity" : "CRITICAL" }, "ZM_A01_DOCUMENTATION_ADDR" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP address(es) intended for documentation purposes: \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#:~:text=A01_DOCUMENTATION_ADDR).", "Severity" : "CRITICAL" }, "ZM_A01_LOCAL_USE_ADDR" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP address(es) intended for local use on network or service provider level: \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#:~:text=A01_LOCAL_USE_ADDR).", "Severity" : "CRITICAL" }, "ZM_A01_NO_GLOBALLY_REACHABLE_ADDR" : { "Description" : "Zonemaster describes this error as follows:\n\n> None of the name servers IP addresses are listed as globally reachable.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#:~:text=A01_NO_GLOBALLY_REACHABLE_ADDR).", "Severity" : "CRITICAL" }, "ZM_A01_NO_NAME_SERVERS_FOUND" : { "Description" : "Zonemaster describes this error as follows:\n\n> No name servers found.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#:~:text=A01_NO_NAME_SERVERS_FOUND).", "Severity" : "CRITICAL" }, "ZM_AAAA_BAD_RDATA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` answered AAAA query with an unexpected RDATA length (`{length}` instead of 16).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#:~:text=AAAA_BAD_RDATA).", "Severity" : "ERROR" }, "ZM_AAAA_QUERY_DROPPED" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` dropped AAAA query.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#:~:text=AAAA_QUERY_DROPPED).", "Severity" : "ERROR" }, "ZM_AAAA_UNEXPECTED_RCODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` answered AAAA query with an unexpected rcode (`{rcode}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#:~:text=AAAA_UNEXPECTED_RCODE).", "Severity" : "ERROR" }, "ZM_A_UNEXPECTED_RCODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` answered A query with an unexpected rcode (`{rcode}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#:~:text=A_UNEXPECTED_RCODE).", "Severity" : "ERROR" }, "ZM_BREAKS_ON_EDNS" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response from `{ns}` when EDNS is used in query asking for `{domain}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#:~:text=BREAKS_ON_EDNS).", "Severity" : "ERROR" }, "ZM_CAN_NOT_BE_RESOLVED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following nameservers failed to resolve to an IP address : `{nsname_list}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver06.html#:~:text=CAN_NOT_BE_RESOLVED).", "Severity" : "ERROR" }, "ZM_CASE_QUERIES_RESULTS_DIFFER" : { "Description" : "Zonemaster describes this error as follows:\n\n> When asked for `{type}` records on \"`{domain}`\" with different cases, all servers do not reply consistently.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver09.html#:~:text=CASE_QUERIES_RESULTS_DIFFER).", "Severity" : "ERROR" }, "ZM_CASE_QUERY_DIFFERENT_ANSWER" : { "Description" : "Zonemaster describes this error as follows:\n\n> When asked for `{type}` records on \"`{query1}`\" and \"`{query2}`\", nameserver `{ns}` returns different answers.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver09.html#:~:text=CASE_QUERY_DIFFERENT_ANSWER).", "Severity" : "WARNING" }, "ZM_CASE_QUERY_DIFFERENT_RC" : { "Description" : "Zonemaster describes this error as follows:\n\n> When asked for `{type}` records on \"`{query1}`\" and \"`{query2}`\", nameserver `{ns}` returns different RCODE (\"`{rcode1}`\" vs \"`{rcode2}`\").\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver09.html#:~:text=CASE_QUERY_DIFFERENT_RC).", "Severity" : "WARNING" }, "ZM_CASE_QUERY_NO_ANSWER" : { "Description" : "Zonemaster describes this error as follows:\n\n> When asked for `{type}` records on \"`{domain}`\", nameserver `{ns}` returns nothing.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver09.html#:~:text=CASE_QUERY_NO_ANSWER).", "Severity" : "WARNING" }, "ZM_CHILD_NS_FAILED" : { "Description" : "Zonemaster describes this error as follows:\n\n> Unexpected or erroneous reply from `{ns}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#:~:text=CHILD_NS_FAILED).", "Severity" : "ERROR" }, "ZM_CHILD_NS_SAME_IP" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP `{ns_ip}` in child refers to multiple nameservers (`{nsname_list}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#:~:text=CHILD_NS_SAME_IP).", "Severity" : "ERROR" }, "ZM_CHILD_ZONE_LAME" : { "Description" : "Zonemaster describes this error as follows:\n\n> Lame delegation.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#:~:text=CHILD_ZONE_LAME).", "Severity" : "ERROR" }, "ZM_CN01_MISSING_NS_RECORD_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds to a NS query with no NS records in the answer section over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_MISSING_NS_RECORD_UDP).", "Severity" : "ERROR" }, "ZM_CN01_MISSING_SOA_RECORD_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds to a SOA query with no SOA records in the answer section over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_MISSING_SOA_RECORD_UDP).", "Severity" : "ERROR" }, "ZM_CN01_NO_RESPONSE_NS_QUERY_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to NS queries over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_NO_RESPONSE_NS_QUERY_UDP).", "Severity" : "ERROR" }, "ZM_CN01_NO_RESPONSE_SOA_QUERY_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to SOA queries over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_NO_RESPONSE_SOA_QUERY_UDP).", "Severity" : "ERROR" }, "ZM_CN01_NO_RESPONSE_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to any queries over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_NO_RESPONSE_UDP).", "Severity" : "ERROR" }, "ZM_CN01_NS_RECORD_NOT_AA_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not give an authoritative response on an NS query over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_NS_RECORD_NOT_AA_UDP).", "Severity" : "ERROR" }, "ZM_CN01_SOA_RECORD_NOT_AA_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not give an authoritative response on an SOA query over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_SOA_RECORD_NOT_AA_UDP).", "Severity" : "ERROR" }, "ZM_CN01_UNEXPECTED_RCODE_NS_QUERY_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with an unexpected RCODE (`{rcode}`) on an NS query over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_UNEXPECTED_RCODE_NS_QUERY_UDP).", "Severity" : "ERROR" }, "ZM_CN01_UNEXPECTED_RCODE_SOA_QUERY_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with an unexpected RCODE (`{rcode}`) on an SOA query over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_UNEXPECTED_RCODE_SOA_QUERY_UDP).", "Severity" : "ERROR" }, "ZM_CN01_WRONG_NS_RECORD_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with a wrong owner name (`{domain_found}` instead of `{domain_expected}`) on NS queries over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_WRONG_NS_RECORD_UDP).", "Severity" : "ERROR" }, "ZM_CN01_WRONG_SOA_RECORD_UDP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with a wrong owner name (`{domain_found}` instead of `{domain_expected}`) on SOA queries over UDP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#:~:text=CN01_WRONG_SOA_RECORD_UDP).", "Severity" : "ERROR" }, "ZM_CN02_MISSING_NS_RECORD_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds to a NS query with no NS records in the answer section over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_MISSING_NS_RECORD_TCP).", "Severity" : "ERROR" }, "ZM_CN02_MISSING_SOA_RECORD_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds to a SOA query with no SOA records in the answer section over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_MISSING_SOA_RECORD_TCP).", "Severity" : "ERROR" }, "ZM_CN02_NO_RESPONSE_NS_QUERY_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to NS queries over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_NO_RESPONSE_NS_QUERY_TCP).", "Severity" : "ERROR" }, "ZM_CN02_NO_RESPONSE_SOA_QUERY_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to SOA queries over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_NO_RESPONSE_SOA_QUERY_TCP).", "Severity" : "ERROR" }, "ZM_CN02_NO_RESPONSE_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not respond to any queries over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_NO_RESPONSE_TCP).", "Severity" : "ERROR" }, "ZM_CN02_NS_RECORD_NOT_AA_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not give an authoritative response on an NS query over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_NS_RECORD_NOT_AA_TCP).", "Severity" : "ERROR" }, "ZM_CN02_SOA_RECORD_NOT_AA_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not give an authoritative response on an SOA query over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_SOA_RECORD_NOT_AA_TCP).", "Severity" : "ERROR" }, "ZM_CN02_UNEXPECTED_RCODE_NS_QUERY_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with an unexpected RCODE (`{rcode}`) on an NS query over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_UNEXPECTED_RCODE_NS_QUERY_TCP).", "Severity" : "ERROR" }, "ZM_CN02_UNEXPECTED_RCODE_SOA_QUERY_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with an unexpected RCODE (`{rcode}`) on an SOA query over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_UNEXPECTED_RCODE_SOA_QUERY_TCP).", "Severity" : "ERROR" }, "ZM_CN02_WRONG_NS_RECORD_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with a wrong owner name (`{domain_found}` instead of `{domain_expected}`) on NS queries over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_WRONG_NS_RECORD_TCP).", "Severity" : "ERROR" }, "ZM_CN02_WRONG_SOA_RECORD_TCP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with a wrong owner name (`{domain_found}` instead of `{domain_expected}`) on SOA queries over TCP.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#:~:text=CN02_WRONG_SOA_RECORD_TCP).", "Severity" : "ERROR" }, "ZM_DEL_NS_SAME_IP" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP `{ns_ip}` in parent refers to multiple nameservers (`{nsname_list}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#:~:text=DEL_NS_SAME_IP).", "Severity" : "ERROR" }, "ZM_DIFFERENT_SOURCE_IP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` replies on a SOA query with a different source address (`{source}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver04.html#:~:text=DIFFERENT_SOURCE_IP).", "Severity" : "ERROR" }, "ZM_DNSKEY_SMALLER_THAN_REC" : { "Description" : "Zonemaster describes this error as follows:\n\n> DNSKEY with tag `{keytag}` and using algorithm `{algo_num}` (`{algo_descr}`) has a size (`{keysize}`) smaller than the recommended one (`{keysizerec}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#:~:text=DNSKEY_SMALLER_THAN_REC).", "Severity" : "WARNING" }, "ZM_DNSKEY_TOO_LARGE_FOR_ALGO" : { "Description" : "Zonemaster describes this error as follows:\n\n> DNSKEY with tag `{keytag}` and using algorithm `{algo_num}` (`{algo_descr}`) has a size (`{keysize}`) larger than the maximum one (`{keysizemax}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#:~:text=DNSKEY_TOO_LARGE_FOR_ALGO).", "Severity" : "ERROR" }, "ZM_DNSKEY_TOO_SMALL_FOR_ALGO" : { "Description" : "Zonemaster describes this error as follows:\n\n> DNSKEY with tag `{keytag}` and using algorithm `{algo_num}` (`{algo_descr}`) has a size (`{keysize}`) smaller than the minimum one (`{keysizemin}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#:~:text=DNSKEY_TOO_SMALL_FOR_ALGO).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_2_MISSING" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is a DS record with keytag `{keytag}`. A DS record using digest algorithm 2 (SHA-256) is missing. Fetched from parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_2_MISSING).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_DEPRECATED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record with keytag `{keytag}` uses a deprecated digest algorithm `{ds_algo_num}` (`{ds_algo_descr}`). Fetched from parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_DEPRECATED).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_NOT_DS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record with keytag `{keytag}` uses a digest algorithm `{ds_algo_num}` (`{ds_algo_descr}`) not meant for DS records. Fetched from parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_NOT_DS).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_PRIVATE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record with keytag `{keytag}` uses a digest algorithm `{ds_algo_num}` for private use. Fetched from parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_PRIVATE).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_RESERVED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record with keytag `{keytag}` uses a reserved digest algorithm `{ds_algo_num}` on name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_RESERVED).", "Severity" : "ERROR" }, "ZM_DS01_DS_ALGO_UNASSIGNED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record with keytag `{keytag}` uses an unassigned digest algorithm `{ds_algo_num}` on parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_DS_ALGO_UNASSIGNED).", "Severity" : "ERROR" }, "ZM_DS01_NO_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response or error in response from all parent name servers on the DS query. Name servers are \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_NO_RESPONSE).", "Severity" : "WARNING" }, "ZM_DS01_PARENT_SERVER_NO_DS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following name servers do not provide DS record or have not been properly configured. Fetched from parent name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#:~:text=DS01_PARENT_SERVER_NO_DS).", "Severity" : "ERROR" }, "ZM_DS02_DNSKEY_NOT_FOR_ZONE_SIGNING" : { "Description" : "Zonemaster describes this error as follows:\n\n> Flags field of DNSKEY record with tag `{keytag}` has not ZONE bit set although DS with same tag is present in parent. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_DNSKEY_NOT_FOR_ZONE_SIGNING).", "Severity" : "ERROR" }, "ZM_DS02_DNSKEY_NOT_SEP" : { "Description" : "Zonemaster describes this error as follows:\n\n> Flags field of DNSKEY record with tag `{keytag}` has not SEP bit set although DS with same tag is present in parent. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_DNSKEY_NOT_SEP).", "Severity" : "ERROR" }, "ZM_DS02_DNSKEY_NOT_SIGNED_BY_ANY_DS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset has not been signed by any DNSKEY matched by a DS record. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_DNSKEY_NOT_SIGNED_BY_ANY_DS).", "Severity" : "ERROR" }, "ZM_DS02_NO_DNSKEY_FOR_DS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY record with tag `{keytag}` that the DS refers to does not exist in the DNSKEY RRset. Fetched from the nameservers with IP \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_NO_DNSKEY_FOR_DS).", "Severity" : "ERROR" }, "ZM_DS02_NO_MATCHING_DNSKEY_RRSIG" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is not signed by the DNSKEY with tag `{keytag}` that the DS record refers to. Fetched from the nameservers with IP \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_NO_MATCHING_DNSKEY_RRSIG).", "Severity" : "ERROR" }, "ZM_DS02_NO_MATCH_DS_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DS record does not match the DNSKEY with tag `{keytag}` by algorithm or digest. Fetched from the nameservers with IP \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_NO_MATCH_DS_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS02_NO_VALID_DNSKEY_FOR_ANY_DS" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is no valid DNSKEY matched by any of the DS records. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_NO_VALID_DNSKEY_FOR_ANY_DS).", "Severity" : "ERROR" }, "ZM_DS02_RRSIG_NOT_VALID_BY_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is signed with an RRSIG with tag `{keytag}` which cannot be validated by the matching DNSKEY. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#:~:text=DS02_RRSIG_NOT_VALID_BY_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS03_ERR_MULT_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> Multiple NSEC3 records when one is expected. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_ERR_MULT_NSEC3).", "Severity" : "ERROR" }, "ZM_DS03_ILLEGAL_HASH_ALGO" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following servers respond with an illegal hash algorithm for NSEC3 (`{algo_num}`). Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_ILLEGAL_HASH_ALGO).", "Severity" : "ERROR" }, "ZM_DS03_ILLEGAL_ITERATION_VALUE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following servers respond with the NSEC3 iteration value `{int}`. The recommended practice is to set this value to 0. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_ILLEGAL_ITERATION_VALUE).", "Severity" : "ERROR" }, "ZM_DS03_ILLEGAL_SALT_LENGTH" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following servers respond with a non-empty salt in NSEC3 (`{int}` octets). The recommended practice is to use an empty salt. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_ILLEGAL_SALT_LENGTH).", "Severity" : "ERROR" }, "ZM_DS03_INCONSISTENT_HASH_ALGO" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent hash algorithm in NSEC3 in responses for the child zone from different name servers.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_INCONSISTENT_HASH_ALGO).", "Severity" : "ERROR" }, "ZM_DS03_INCONSISTENT_ITERATION" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent NSEC3 iteration value in responses for the child zone from different name servers.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_INCONSISTENT_ITERATION).", "Severity" : "ERROR" }, "ZM_DS03_INCONSISTENT_NSEC3_FLAGS" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent NSEC3 flag list in responses for the child zone from different name servers.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_INCONSISTENT_NSEC3_FLAGS).", "Severity" : "ERROR" }, "ZM_DS03_INCONSISTENT_SALT_LENGTH" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent salt length in NSEC3 in responses for the child zone from different name servers.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_INCONSISTENT_SALT_LENGTH).", "Severity" : "ERROR" }, "ZM_DS03_NO_DNSSEC_SUPPORT" : { "Description" : "Zonemaster describes this error as follows:\n\n> The zone is not DNSSEC signed or not properly DNSSEC signed. Testing for NSEC3 has been skipped. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_NO_DNSSEC_SUPPORT).", "Severity" : "CRITICAL" }, "ZM_DS03_SERVER_NO_DNSSEC_SUPPORT" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following name servers do not support DNSSEC or have not been properly configured. Testing for NSEC3 has been skipped on those servers. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_SERVER_NO_DNSSEC_SUPPORT).", "Severity" : "ERROR" }, "ZM_DS03_SERVER_NO_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following name servers do not use NSEC3, but others do. Testing for NSEC3 has been skipped on the following servers. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_SERVER_NO_NSEC3).", "Severity" : "ERROR" }, "ZM_DS03_UNASSIGNED_FLAG_USED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following servers respond with an NSEC3 record where an unassigned flag is used (bit `{int}`). Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#:~:text=DS03_UNASSIGNED_FLAG_USED).", "Severity" : "ERROR" }, "ZM_DS05_ALGO_DEPRECATED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses deprecated algorithm number `{algo_num}` (\"`{algo_descr}`\", `{algo_mnemo}`). Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_DEPRECATED).", "Severity" : "ERROR" }, "ZM_DS05_ALGO_NOT_RECOMMENDED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses unrecommended algorithm number `{algo_num}` (\"`{algo_descr}`\", `{algo_mnemo}`). Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_NOT_RECOMMENDED).", "Severity" : "WARNING" }, "ZM_DS05_ALGO_NOT_ZONE_SIGN" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses algorithm number `{algo_num}` (\"`{algo_descr}`\", `{algo_mnemo}`) which is not meant for zone signing. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_NOT_ZONE_SIGN).", "Severity" : "ERROR" }, "ZM_DS05_ALGO_PRIVATE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses algorithm number `{algo_num}` which is reserved for private use. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_PRIVATE).", "Severity" : "ERROR" }, "ZM_DS05_ALGO_RESERVED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses reserved algorithm number `{algo_num}`. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_RESERVED).", "Severity" : "ERROR" }, "ZM_DS05_ALGO_UNASSIGNED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY with tag `{keytag}` uses unassigned algorithm number `{algo_num}`. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_ALGO_UNASSIGNED).", "Severity" : "ERROR" }, "ZM_DS05_NO_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response or error in response from all name servers on the DNSKEY query. Failing name servers: \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_NO_RESPONSE).", "Severity" : "WARNING" }, "ZM_DS05_SERVER_NO_DNSSEC" : { "Description" : "Zonemaster describes this error as follows:\n\n> Some name servers do not support DNSSEC or have not been properly configured. DNSKEY cannot be tested on those servers. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#:~:text=DS05_SERVER_NO_DNSSEC).", "Severity" : "CRITICAL" }, "ZM_DS08_DNSKEY_RRSIG_EXPIRED" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type DNSKEY has already expired. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#:~:text=DS08_DNSKEY_RRSIG_EXPIRED).", "Severity" : "ERROR" }, "ZM_DS08_DNSKEY_RRSIG_NOT_YET_VALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type DNSKEY has inception date in the future. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#:~:text=DS08_DNSKEY_RRSIG_NOT_YET_VALID).", "Severity" : "ERROR" }, "ZM_DS08_MISSING_RRSIG_IN_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is not signed, which is against expectation. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#:~:text=DS08_MISSING_RRSIG_IN_RESPONSE).", "Severity" : "ERROR" }, "ZM_DS08_NO_MATCHING_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is signed with an RRSIG with tag `{keytag}` which does not match any DNSKEY record. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#:~:text=DS08_NO_MATCHING_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS08_RRSIG_NOT_VALID_BY_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is signed with an RRSIG with tag `{keytag}` which cannot be validated by the matching DNSKEY. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#:~:text=DS08_RRSIG_NOT_VALID_BY_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS09_MISSING_RRSIG_IN_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RRset is not signed, which is against expectation. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#:~:text=DS09_MISSING_RRSIG_IN_RESPONSE).", "Severity" : "ERROR" }, "ZM_DS09_NO_MATCHING_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RRset is signed with an RRSIG with tag `{keytag}` which does not match any DNSKEY record. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#:~:text=DS09_NO_MATCHING_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS09_RRSIG_NOT_VALID_BY_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RRset is signed with an RRSIG with tag `{keytag}` which cannot be validated by the matching DNSKEY. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#:~:text=DS09_RRSIG_NOT_VALID_BY_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS09_SOA_RRSIG_EXPIRED" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type SOA has already expired. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#:~:text=DS09_SOA_RRSIG_EXPIRED).", "Severity" : "ERROR" }, "ZM_DS09_SOA_RRSIG_NOT_YET_VALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type SOA has inception date in the future. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#:~:text=DS09_SOA_RRSIG_NOT_YET_VALID).", "Severity" : "ERROR" }, "ZM_DS10_ERR_MULT_NSEC" : { "Description" : "Zonemaster describes this error as follows:\n\n> Multiple NSEC records when one is expected. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_ERR_MULT_NSEC).", "Severity" : "ERROR" }, "ZM_DS10_ERR_MULT_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> Multiple NSEC3 records when one is expected. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_ERR_MULT_NSEC3).", "Severity" : "ERROR" }, "ZM_DS10_ERR_MULT_NSEC3PARAM" : { "Description" : "Zonemaster describes this error as follows:\n\n> Multiple NSEC3PARAM records when one is expected. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_ERR_MULT_NSEC3PARAM).", "Severity" : "ERROR" }, "ZM_DS10_EXPECTED_NSEC_NSEC3_MISSING" : { "Description" : "Zonemaster describes this error as follows:\n\n> The server responded with DNSKEY but not with expected NSEC or NSEC3. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_EXPECTED_NSEC_NSEC3_MISSING).", "Severity" : "ERROR" }, "ZM_DS10_INCONSISTENT_NSEC" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent responses from zone with NSEC. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_INCONSISTENT_NSEC).", "Severity" : "ERROR" }, "ZM_DS10_INCONSISTENT_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> Inconsistent responses from zone with NSEC3. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_INCONSISTENT_NSEC3).", "Severity" : "ERROR" }, "ZM_DS10_INCONSISTENT_NSEC_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> The zone is inconsistent on NSEC and NSEC3. NSEC is fetched from name servers \"`{ns_list_nsec}`\". NSEC3 is fetched from name servers \"`{ns_list_nsec3}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_INCONSISTENT_NSEC_NSEC3).", "Severity" : "ERROR" }, "ZM_DS10_MIXED_NSEC_NSEC3" : { "Description" : "Zonemaster describes this error as follows:\n\n> The zone responds with both NSEC and NSEC3, where only one of them is expected. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_MIXED_NSEC_NSEC3).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3PARAM_GIVES_ERR_ANSWER" : { "Description" : "Zonemaster describes this error as follows:\n\n> Unexpected DNS record in the answer section on an NSEC3PARAM query. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3PARAM_GIVES_ERR_ANSWER).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3PARAM_MISMATCHES_APEX" : { "Description" : "Zonemaster describes this error as follows:\n\n> The returned NSEC3PARAM record has an unexpected non-apex owner name. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3PARAM_MISMATCHES_APEX).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3PARAM_QUERY_RESPONSE_ERR" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response or error in response on query for NSEC3PARAM. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3PARAM_QUERY_RESPONSE_ERR).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_ERR_TYPE_LIST" : { "Description" : "Zonemaster describes this error as follows:\n\n> NSEC3 record for the zone apex with incorrect type list. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_ERR_TYPE_LIST).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_MISMATCHES_APEX" : { "Description" : "Zonemaster describes this error as follows:\n\n> The returned NSEC3 record unexpectedly does not match the zone name. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_MISMATCHES_APEX).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_MISSING_SIGNATURE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Missing RRSIG (signature) for the NSEC3 record or records. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_MISSING_SIGNATURE).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_NODATA_MISSING_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Missing SOA record in NODATA response with NSEC3. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_NODATA_MISSING_SOA).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_NODATA_WRONG_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Wrong owner name (\"`{domain}`\") on SOA record in NODATA response with NSEC3. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_NODATA_WRONG_SOA).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_NO_VERIFIED_SIGNATURE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) for the NSEC3 record cannot be verified. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_NO_VERIFIED_SIGNATURE).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_RRSIG_EXPIRED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC3 record has expired. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_RRSIG_EXPIRED).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_RRSIG_NOT_YET_VALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC3 record it not yet valid. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_RRSIG_NOT_YET_VALID).", "Severity" : "ERROR" }, "ZM_DS10_NSEC3_RRSIG_NO_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is no DNSKEY record matching the RRSIG (signature) with tag `{keytag}` for the NSEC3 record. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_RRSIG_NO_DNSKEY).", "Severity" : "WARNING" }, "ZM_DS10_NSEC3_RRSIG_VERIFY_ERROR" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC3 record cannot be verified. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC3_RRSIG_VERIFY_ERROR).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_ERR_TYPE_LIST" : { "Description" : "Zonemaster describes this error as follows:\n\n> NSEC record for the zone apex with incorrect type list. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_ERR_TYPE_LIST).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_GIVES_ERR_ANSWER" : { "Description" : "Zonemaster describes this error as follows:\n\n> Unexpected DNS record in the answer section on an NSEC query. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_GIVES_ERR_ANSWER).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_MISMATCHES_APEX" : { "Description" : "Zonemaster describes this error as follows:\n\n> The returned NSEC record has an unexpected non-apex owner name. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_MISMATCHES_APEX).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_MISSING_SIGNATURE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Missing RRSIG (signature) for the NSEC record or records. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_MISSING_SIGNATURE).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_NODATA_MISSING_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Missing SOA record in NODATA response with NSEC. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_NODATA_MISSING_SOA).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_NODATA_WRONG_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Wrong owner name (\"`{domain}`\") on SOA record in NODATA response with NSEC. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_NODATA_WRONG_SOA).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_NO_VERIFIED_SIGNATURE" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is no RRSIG (signature) for the NSEC record that can be verified. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_NO_VERIFIED_SIGNATURE).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_QUERY_RESPONSE_ERR" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response or error in response on query for NSEC. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_QUERY_RESPONSE_ERR).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_RRSIG_EXPIRED" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC record has expired. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_RRSIG_EXPIRED).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_RRSIG_NOT_YET_VALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC record it not yet valid. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_RRSIG_NOT_YET_VALID).", "Severity" : "ERROR" }, "ZM_DS10_NSEC_RRSIG_NO_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is no DNSKEY record matching the RRSIG (signature) with tag `{keytag}` for the NSEC record. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_RRSIG_NO_DNSKEY).", "Severity" : "WARNING" }, "ZM_DS10_NSEC_RRSIG_VERIFY_ERROR" : { "Description" : "Zonemaster describes this error as follows:\n\n> The RRSIG (signature) with tag `{keytag}` for the NSEC record cannot be verified. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_NSEC_RRSIG_VERIFY_ERROR).", "Severity" : "ERROR" }, "ZM_DS10_SERVER_NO_DNSSEC" : { "Description" : "Zonemaster describes this error as follows:\n\n> The following name servers do not support DNSSEC or have not been properly configured. Testing for NSEC and NSEC3 has been skipped on these servers. Fetched from name servers \"`{ns_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#:~:text=DS10_SERVER_NO_DNSSEC).", "Severity" : "ERROR" }, "ZM_DS13_ALGO_NOT_SIGNED_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNSKEY RRset is not signed by algorithm `{algo_num}` (`{algo_mnemo}`) present in the DNSKEY RRset. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#:~:text=DS13_ALGO_NOT_SIGNED_DNSKEY).", "Severity" : "ERROR" }, "ZM_DS13_ALGO_NOT_SIGNED_NS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The NS RRset is not signed by algorithm `{algo_num}` (`{algo_mnemo}`) present in the DNSKEY RRset. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#:~:text=DS13_ALGO_NOT_SIGNED_NS).", "Severity" : "ERROR" }, "ZM_DS13_ALGO_NOT_SIGNED_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RRset is not signed by algorithm `{algo_num}` (`{algo_mnemo}`) present in the DNSKEY RRset. Fetched from the nameservers with IP addresses \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#:~:text=DS13_ALGO_NOT_SIGNED_SOA).", "Severity" : "ERROR" }, "ZM_DURATION_LONG" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type(s) `{types}` has a duration of `{duration}` seconds, which is too long.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec04.html#:~:text=DURATION_LONG).", "Severity" : "WARNING" }, "ZM_EDNS_RESPONSE_WITHOUT_EDNS" : { "Description" : "Zonemaster describes this error as follows:\n\n> Response without EDNS from `{ns}` on query with EDNS0 asking for `{domain}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#:~:text=EDNS_RESPONSE_WITHOUT_EDNS).", "Severity" : "ERROR" }, "ZM_EDNS_VERSION_ERROR" : { "Description" : "Zonemaster describes this error as follows:\n\n> Incorrect version of EDNS (expected 0) in response from `{ns}` on query with EDNS (version 0) asking for `{domain}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#:~:text=EDNS_VERSION_ERROR).", "Severity" : "ERROR" }, "ZM_EXTRA_ADDRESS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child has extra nameserver IP address(es) not listed at parent (`{ns_ip_list}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#:~:text=EXTRA_ADDRESS_CHILD).", "Severity" : "ERROR" }, "ZM_EXTRA_NAME_PARENT" : { "Description" : "Zonemaster describes this error as follows:\n\n> Parent has nameserver(s) not listed at the child (`{extra}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation07.html#:~:text=EXTRA_NAME_PARENT).", "Severity" : "ERROR" }, "ZM_EXTRA_PROCESSING_BROKEN" : { "Description" : "Zonemaster describes this error as follows:\n\n> Server at `{server}` sent `{keys}` DNSKEY records, and `{sigs}` RRSIG records.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec06.html#:~:text=EXTRA_PROCESSING_BROKEN).", "Severity" : "ERROR" }, "ZM_IN_BAILIWICK_ADDR_MISMATCH" : { "Description" : "Zonemaster describes this error as follows:\n\n> In-bailiwick name server listed at parent has a mismatch between glue data at parent (`{parent_addresses}`) and any equivalent address record in child zone (`{zone_addresses}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#:~:text=IN_BAILIWICK_ADDR_MISMATCH).", "Severity" : "ERROR" }, "ZM_IPV4_ONE_ASN" : { "Description" : "Zonemaster describes this error as follows:\n\n> All authoritative nameservers have their IPv4 addresses in the same AS (`{asn}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity03.html#:~:text=IPV4_ONE_ASN).", "Severity" : "ERROR" }, "ZM_IPV6_ONE_ASN" : { "Description" : "Zonemaster describes this error as follows:\n\n> All authoritative nameservers have their IPv6 addresses in the same AS (`{asn}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity03.html#:~:text=IPV6_ONE_ASN).", "Severity" : "ERROR" }, "ZM_IS_A_RECURSOR" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` is a recursor.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html#:~:text=IS_A_RECURSOR).", "Severity" : "ERROR" }, "ZM_IS_NOT_AUTHORITATIVE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` response is not authoritative on `{proto}` port 53.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation04.html#:~:text=IS_NOT_AUTHORITATIVE).", "Severity" : "WARNING" }, "ZM_MISSING_OPT_IN_TRUNCATED" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` replies on an EDNS query with a truncated response without EDNS.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#:~:text=MISSING_OPT_IN_TRUNCATED).", "Severity" : "ERROR" }, "ZM_MNAME_DISCOURAGED_DOUBLE_DASH" : { "Description" : "Zonemaster describes this error as follows:\n\n> SOA MNAME (`{domain}`) has a label (`{label}`) with a double hyphen ('--') in position 3 and 4 (with a prefix which is not 'xn--').\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax07.html#:~:text=MNAME_DISCOURAGED_DOUBLE_DASH).", "Severity" : "WARNING" }, "ZM_MNAME_HAS_NO_ADDRESS" : { "Description" : "Zonemaster describes this error as follows:\n\n> No IP address found for SOA 'mname' nameserver (`{mname}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone07.html#:~:text=MNAME_HAS_NO_ADDRESS).", "Severity" : "WARNING" }, "ZM_MNAME_NON_ALLOWED_CHARS" : { "Description" : "Zonemaster describes this error as follows:\n\n> Found illegal characters in SOA MNAME (`{domain}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax07.html#:~:text=MNAME_NON_ALLOWED_CHARS).", "Severity" : "WARNING" }, "ZM_MNAME_NUMERIC_TLD" : { "Description" : "Zonemaster describes this error as follows:\n\n> SOA MNAME (`{domain}`) within a 'numeric only' TLD (`{tld}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax07.html#:~:text=MNAME_NUMERIC_TLD).", "Severity" : "WARNING" }, "ZM_MULTIPLE_NS_SET" : { "Description" : "Zonemaster describes this error as follows:\n\n> Found `{count}` NS set(s).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#:~:text=MULTIPLE_NS_SET).", "Severity" : "ERROR" }, "ZM_MULTIPLE_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with multiple (`{count}`) SOA records on SOA queries.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#:~:text=MULTIPLE_SOA).", "Severity" : "ERROR" }, "ZM_MULTIPLE_SOA_MNAMES" : { "Description" : "Zonemaster describes this error as follows:\n\n> Saw `{count}` SOA mname.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html#:~:text=MULTIPLE_SOA_MNAMES).", "Severity" : "ERROR" }, "ZM_MULTIPLE_SOA_RNAMES" : { "Description" : "Zonemaster describes this error as follows:\n\n> Found `{count}` SOA rname(s).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html#:~:text=MULTIPLE_SOA_RNAMES).", "Severity" : "ERROR" }, "ZM_MULTIPLE_SOA_TIME_PARAMETER_SET" : { "Description" : "Zonemaster describes this error as follows:\n\n> Found `{count}` SOA time parameter set(s).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html#:~:text=MULTIPLE_SOA_TIME_PARAMETER_SET).", "Severity" : "ERROR" }, "ZM_N10_EDNS_RESPONSE_ERROR" : { "Description" : "Zonemaster describes this error as follows:\n\n> Expected RCODE but received erroneous response to an EDNS version 1 query. Fetched from the nameservers with IP addresses `{ns_ip_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#:~:text=N10_EDNS_RESPONSE_ERROR).", "Severity" : "ERROR" }, "ZM_N10_NO_RESPONSE_EDNS1_QUERY" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response to an EDNS version 1 query. Fetched from the nameservers with IP addresses `{ns_ip_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#:~:text=N10_NO_RESPONSE_EDNS1_QUERY).", "Severity" : "ERROR" }, "ZM_N10_UNEXPECTED_RCODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Erroneous RCODE (\"`{rcode}`\") in response to an EDNS version 1 query. Fetched from the nameservers with IP addresses `{ns_ip_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#:~:text=N10_UNEXPECTED_RCODE).", "Severity" : "ERROR" }, "ZM_N11_NO_EDNS" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNS response, on query with unknown EDNS option-code, does not contain any EDNS from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_NO_EDNS).", "Severity" : "ERROR" }, "ZM_N11_NO_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> There is no response on query with unknown EDNS option-code from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_NO_RESPONSE).", "Severity" : "ERROR" }, "ZM_N11_RETURNS_UNKNOWN_OPTION_CODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNS response contains an unknown EDNS option-code. Returned from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_RETURNS_UNKNOWN_OPTION_CODE).", "Severity" : "ERROR" }, "ZM_N11_UNEXPECTED_ANSWER_SECTION" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNS response, on query with unknown EDNS option-code, does not contain the expected SOA record in the answer section from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_UNEXPECTED_ANSWER_SECTION).", "Severity" : "ERROR" }, "ZM_N11_UNEXPECTED_RCODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNS response, on query with unknown EDNS option-code, has unexpected RCODE name \"`{rcode}`\" from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_UNEXPECTED_RCODE).", "Severity" : "ERROR" }, "ZM_N11_UNSET_AA" : { "Description" : "Zonemaster describes this error as follows:\n\n> The DNS response, on query with unknown EDNS option-code, is unexpectedly not authoritative from name servers \"`{ns_ip_list}`\".\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#:~:text=N11_UNSET_AA).", "Severity" : "ERROR" }, "ZM_NAMESERVER_IP_WITHOUT_REVERSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{nsname}` has an IP address (`{ns_ip}`) without PTR configured.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address03.html#:~:text=NAMESERVER_IP_WITHOUT_REVERSE).", "Severity" : "WARNING" }, "ZM_NOT_ENOUGH_IPV4_NS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child does not list enough (`{count}`) nameservers that resolve to IPv4 addresses. Lower limit set to `{minimum}`. Name servers: `{ns_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_IPV4_NS_CHILD).", "Severity" : "ERROR" }, "ZM_NOT_ENOUGH_IPV4_NS_DEL" : { "Description" : "Zonemaster describes this error as follows:\n\n> Delegation does not list enough (`{count}`) nameservers that resolve to IPv4 addresses. Lower limit set to `{minimum}`. Name servers: `{ns_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_IPV4_NS_DEL).", "Severity" : "ERROR" }, "ZM_NOT_ENOUGH_IPV6_NS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child does not list enough (`{count}`) nameservers that resolve to IPv6 addresses. Lower limit set to `{minimum}`. Name servers: `{ns_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_IPV6_NS_CHILD).", "Severity" : "ERROR" }, "ZM_NOT_ENOUGH_IPV6_NS_DEL" : { "Description" : "Zonemaster describes this error as follows:\n\n> Delegation does not list enough (`{count}`) nameservers that resolve to IPv6 addresses. Lower limit set to `{minimum}`. Name servers: `{ns_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_IPV6_NS_DEL).", "Severity" : "ERROR" }, "ZM_NOT_ENOUGH_NS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child does not list enough (`{count}`) nameservers. Lower limit set to `{minimum}`. Name servers: `{nsname_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_NS_CHILD).", "Severity" : "ERROR" }, "ZM_NOT_ENOUGH_NS_DEL" : { "Description" : "Zonemaster describes this error as follows:\n\n> Delegation does not list enough (`{count}`) nameservers. Lower limit set to `{minimum}`. Name servers: `{nsname_list}`\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NOT_ENOUGH_NS_DEL).", "Severity" : "ERROR" }, "ZM_NO_EDNS_SUPPORT" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not support EDNS0 (replies with FORMERR).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#:~:text=NO_EDNS_SUPPORT).", "Severity" : "ERROR" }, "ZM_NO_IPV4_NS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child lists no nameserver that resolves to an IPv4 address. If any were present, the minimum allowed would be `{minimum}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NO_IPV4_NS_CHILD).", "Severity" : "ERROR" }, "ZM_NO_IPV4_NS_DEL" : { "Description" : "Zonemaster describes this error as follows:\n\n> Delegation lists no nameserver that resolves to an IPv4 address. If any were present, the minimum allowed would be `{minimum}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NO_IPV4_NS_DEL).", "Severity" : "ERROR" }, "ZM_NO_IPV6_NS_CHILD" : { "Description" : "Zonemaster describes this error as follows:\n\n> Child lists no nameserver that resolves to an IPv6 address. If any were present, the minimum allowed would be `{minimum}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NO_IPV6_NS_CHILD).", "Severity" : "ERROR" }, "ZM_NO_IPV6_NS_DEL" : { "Description" : "Zonemaster describes this error as follows:\n\n> Delegation lists no nameserver that resolves to an IPv6 address. If any were present, the minimum allowed would be `{minimum}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#:~:text=NO_IPV6_NS_DEL).", "Severity" : "ERROR" }, "ZM_NO_RESOLUTION" : { "Description" : "Zonemaster describes this error as follows:\n\n> No nameserver was successfully resolved to an IP address.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver06.html#:~:text=NO_RESOLUTION).", "Severity" : "ERROR" }, "ZM_NO_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` did not respond.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#:~:text=NO_RESPONSE).", "Severity" : "ERROR" }, "ZM_NO_RESPONSE_DNSKEY" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responded with no DNSKEY record(s).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#:~:text=NO_RESPONSE_DNSKEY).", "Severity" : "ERROR" }, "ZM_NO_RESPONSE_NS_QUERY" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response from nameserver `{ns}` on NS queries.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#:~:text=NO_RESPONSE_NS_QUERY).", "Severity" : "ERROR" }, "ZM_NO_RESPONSE_PTR_QUERY" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response from nameserver(s) on PTR query (`{domain}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address03.html#:~:text=NO_RESPONSE_PTR_QUERY).", "Severity" : "WARNING" }, "ZM_NO_RESPONSE_SOA_QUERY" : { "Description" : "Zonemaster describes this error as follows:\n\n> No response from nameserver(s) on SOA queries.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone07.html#:~:text=NO_RESPONSE_SOA_QUERY).", "Severity" : "ERROR" }, "ZM_NO_SOA_IN_RESPONSE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Response from nameserver `{ns}` on SOA queries does not contain SOA record.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#:~:text=NO_SOA_IN_RESPONSE).", "Severity" : "ERROR" }, "ZM_NS_ERROR" : { "Description" : "Zonemaster describes this error as follows:\n\n> Erroneous response from nameserver `{ns}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#:~:text=NS_ERROR).", "Severity" : "ERROR" }, "ZM_NS_IS_CNAME" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{nsname}` RR points to CNAME.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#:~:text=NS_IS_CNAME).", "Severity" : "ERROR" }, "ZM_OUT_OF_BAILIWICK_ADDR_MISMATCH" : { "Description" : "Zonemaster describes this error as follows:\n\n> Out-of-bailiwick name server listed at parent with glue record has a mismatch between the glue at the parent (`{parent_addresses}`) and any equivalent address record found in authoritative zone (`{zone_addresses}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#:~:text=OUT_OF_BAILIWICK_ADDR_MISMATCH).", "Severity" : "ERROR" }, "ZM_QNAME_CASE_INSENSITIVE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` does not preserve original case of the queried name (`{domain}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver08.html#:~:text=QNAME_CASE_INSENSITIVE).", "Severity" : "WARNING" }, "ZM_REFERRAL_SIZE_TOO_LARGE" : { "Description" : "Zonemaster describes this error as follows:\n\n> The smallest possible legal referral packet is larger than 512 octets (it is `{size}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html#:~:text=REFERRAL_SIZE_TOO_LARGE).", "Severity" : "ERROR" }, "ZM_REMAINING_LONG" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type(s) `{types}` has a remaining validity of `{duration}` seconds, which is too long.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec04.html#:~:text=REMAINING_LONG).", "Severity" : "WARNING" }, "ZM_REMAINING_SHORT" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type(s) `{types}` has a remaining validity of `{duration}` seconds, which is too short.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec04.html#:~:text=REMAINING_SHORT).", "Severity" : "WARNING" }, "ZM_RNAME_MAIL_DOMAIN_INVALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RNAME mail domain (`{domain}`) cannot be resolved to a mail server with an IP address.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#:~:text=RNAME_MAIL_DOMAIN_INVALID).", "Severity" : "ERROR" }, "ZM_RNAME_MAIL_DOMAIN_LOCALHOST" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RNAME mail domain (`{domain}`) resolved to a mail server with localhost (`{localhost}`) IP address.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#:~:text=RNAME_MAIL_DOMAIN_LOCALHOST).", "Severity" : "ERROR" }, "ZM_RNAME_MAIL_ILLEGAL_CNAME" : { "Description" : "Zonemaster describes this error as follows:\n\n> The SOA RNAME mail domain (`{domain}`) refers to an address which is an alias (CNAME).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#:~:text=RNAME_MAIL_ILLEGAL_CNAME).", "Severity" : "ERROR" }, "ZM_RNAME_MISUSED_AT_SIGN" : { "Description" : "Zonemaster describes this error as follows:\n\n> Misused '@' character found in SOA RNAME field (`{rname}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax05.html#:~:text=RNAME_MISUSED_AT_SIGN).", "Severity" : "ERROR" }, "ZM_RNAME_RFC822_INVALID" : { "Description" : "Zonemaster describes this error as follows:\n\n> Illegal character(s) found in SOA RNAME field (`{rname}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#:~:text=RNAME_RFC822_INVALID).", "Severity" : "ERROR" }, "ZM_RRSIG_EXPIRED" : { "Description" : "Zonemaster describes this error as follows:\n\n> RRSIG with keytag `{keytag}` and covering type(s) `{types}` has already expired (expiration is: `{expiration}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec04.html#:~:text=RRSIG_EXPIRED).", "Severity" : "ERROR" }, "ZM_SAME_IP_ADDRESS" : { "Description" : "Zonemaster describes this error as follows:\n\n> IP `{ns_ip}` refers to multiple nameservers (`{nsname_list}`).\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#:~:text=SAME_IP_ADDRESS).", "Severity" : "ERROR" }, "ZM_TOTAL_NAME_MISMATCH" : { "Description" : "Zonemaster describes this error as follows:\n\n> None of the nameservers listed at the parent are listed at the child.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation07.html#:~:text=TOTAL_NAME_MISMATCH).", "Severity" : "ERROR" }, "ZM_UNEXPECTED_RCODE" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` answered query for name `{query_name}` and type `{rrtype}` with RCODE `{rcode}`.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#:~:text=UNEXPECTED_RCODE).", "Severity" : "WARNING" }, "ZM_WRONG_SOA" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` responds with a wrong owner name (`{owner}` instead of `{name}`) on SOA queries.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#:~:text=WRONG_SOA).", "Severity" : "ERROR" }, "ZM_Z_FLAGS_NOTCLEAR" : { "Description" : "Zonemaster describes this error as follows:\n\n> Nameserver `{ns}` has one or more unknown EDNS Z flag bits set.\n\nFor more information about this error, please refer to [the documentation for the test case this error comes from](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html#:~:text=Z_FLAGS_NOTCLEAR).", "Severity" : "ERROR" } }, "Input-Parameters" : { "dns.gluePolicy" : { "Description" : "The policy explicitly or implicitly applied to glue records, that is, the\nIPv4 and IPv6 addresses provided by registrars for nameservers.\n\nThe possible values of this input parameter are `narrow` and `wide`, which\nare taken from [Section 4 of\ndraft-koch-dns-glue-clarifications](https://datatracker.ietf.org/doc/html/draft-koch-dns-glue-clarifications-05#section-4):\n\n* \"narrow\": Glue RRs are published if the name server resides within or\n below the delegated (child) zone.\n* \"wide\": Glue RRs are published if the name server resides below the\n delegating (parent) zone.\n", "Example" : "narrow", "Required" : "1", "Schema" : { "enum" : [ "narrow", "wide" ], "type" : "string" }, "Type" : "input" }, "dns.nameservers" : { "Description" : "The set of nameservers that will be authoritative for the TLD.\n\nThis input parameter is an array containing objects representing TLDs, and\nthe corresponding nameservers.\n\nThere **MUST** be an entry for every TLD in the TLD set.\n", "Example" : [ { "name" : "example", "nameservers" : [ { "name" : "ns1.example.com", "supportsDoT" : "1", "v4Addrs" : [ "192.0.2.1" ], "v6Addrs" : [ "2001:DB8::53:1" ] }, { "name" : "ns2.example.net", "supportsDoH" : "1", "v4Addrs" : [ "192.0.2.2" ], "v6Addrs" : [ "2001:DB8::53:2" ] } ] } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "name" : { "description" : "The TLD name.", "format" : "hostname", "type" : "string" }, "nameservers" : { "description" : "The nameservers for the TLD", "items" : { "properties" : { "name" : { "description" : "The fully-qualified nameserver name.", "format" : "hostname", "type" : "string" }, "supportsDoH" : { "default" : "", "description" : "Whether this nameserver supports DNS over HTTPS ([RFC\n8484](https://www.rfc-editor.org/rfc/rfc8484.html)).\n", "type" : "boolean" }, "supportsDoQ" : { "default" : "", "description" : "Whether this nameserver supports DNS over Dedicated QUIC\nConnections ([RFC\n9250](https://www.rfc-editor.org/rfc/rfc9250.html)).\n", "type" : "boolean" }, "supportsDoT" : { "default" : "", "description" : "Whether this nameserver supports DNS over TLS ([RFC\n7858](https://www.rfc-editor.org/rfc/rfc7858.html)).\n", "type" : "boolean" }, "v4Addrs" : { "description" : "The IPv4 address(es) for the nameserver.", "items" : { "format" : "ipv4", "type" : "string" }, "minItems" : "1", "type" : "array" }, "v6Addrs" : { "description" : "The IPv6 address(es) for the nameserver.", "items" : { "format" : "ipv6", "type" : "string" }, "minItems" : "1", "type" : "array" } }, "required" : [ "name" ], "type" : "object" }, "minItems" : "2", "type" : "array" } }, "required" : [ "name", "nameservers" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "dnssec.dsRecords" : { "Description" : "The DS record(s) that may be used to validate the DNSSEC signature for the\nTLD(s). This input parameter is an array containing objects representing\nTLDs, and the corresponding DS record(s).\n\nThere **MUST** be an entry for every TLD in the TLD set and there **MUST**\nbe at least one DS record for each TLD.\n", "Example" : [ { "dsRecords" : [ { "alg" : "8", "digest" : "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D", "digestType" : "2", "keyTag" : "12345" } ], "name" : "example" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "dsRecords" : { "description" : "the DS record(s)", "items" : { "properties" : { "alg" : { "format" : "uint16", "type" : "integer" }, "digest" : { "pattern" : "^[0-9A-Fa-f]+$", "type" : "string" }, "digestType" : { "format" : "uint16", "type" : "integer" }, "keyTag" : { "format" : "uint16", "type" : "integer" } }, "required" : [ "keyTag", "alg", "digestType", "digest" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "name" : { "description" : "the zone name", "format" : "hostname", "type" : "string" } }, "required" : [ "name", "dsRecords" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "dnssecOps.algorithmRolloverZone" : { "Description" : "The domain name which will be monitored for the occurrence of an algorithm\nrollover.\n\nThis value of this input parameter **MUST NOT** be the same as the values of\nthe `dnssecOps.kskRolloverZone` and `dnssecOps.zskRolloverZone`\nparameters.\n", "Example" : "example.com", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "dnssecOps.csk" : { "Description" : "A boolean indicating whether the RSP uses a Combined Signing Key (CSK,\nalso referred to as a \"Single Type Signing Scheme\") instead of a split\nKSK/ZSK configuration.\n", "Example" : "", "Required" : "1", "Schema" : { "type" : "boolean" }, "Type" : "input" }, "dnssecOps.kskRolloverZone" : { "Description" : "The domain name which will be monitored for the occurrence of a KSK\nrollover.\n\nThis value of this input parameter **MUST NOT** be the same as the values of\nthe `dnssecOps.zskRolloverZone` and `dnssecOps.algorithmRolloverZone`\nparameters.\n", "Example" : "example.com", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "dnssecOps.nameservers" : { "Description" : "The set of nameservers that will be authoritative for the zones used in the\nDNSSEC operations test suite.\n", "Example" : [ { "name" : "ns1.example.com", "v4Addrs" : [ "192.0.2.1" ], "v6Addrs" : [ "2001:DB8::53:1" ] }, { "name" : "ns2.example.net", "v4Addrs" : [ "192.0.2.2" ], "v6Addrs" : [ "2001:DB8::53:2" ] } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "name" : { "description" : "The fully-qualified nameserver name.", "format" : "hostname", "type" : "string" }, "v4Addrs" : { "description" : "The IPv4 address(es) for the nameserver.", "items" : { "format" : "ipv4", "type" : "string" }, "minItems" : "1", "type" : "array" }, "v6Addrs" : { "description" : "The IPv6 address(es) for the nameserver.", "items" : { "format" : "ipv6", "type" : "string" }, "minItems" : "1", "type" : "array" } }, "required" : [ "name" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "dnssecOps.primaryServers" : { "Description" : "The primary nameserver(s) from which zones can be transferred. At least one\nIPv4 or IPv6 address **MUST** be provided.\n", "Example" : { "v4Addrs" : [ "192.0.2.1" ], "v6Addrs" : [ "2001:DB8::53:2" ] }, "Required" : "1", "Schema" : { "properties" : { "v4Addrs" : { "description" : "The IPv4 address(es) for the primary server(s).", "items" : { "format" : "ipv4", "type" : "string" }, "minItems" : "1", "type" : "array" }, "v6Addrs" : { "description" : "The IPv6 address(es) for the primary server(s).", "items" : { "format" : "ipv6", "type" : "string" }, "minItems" : "1", "type" : "array" } }, "type" : "object" }, "Type" : "input" }, "dnssecOps.tsigKey" : { "Description" : "The TSIG key which should be used to perform zone transfers.", "Example" : { "algorithm" : "hmac-sha256", "name" : "rst-tsig-01", "secret" : "cSevMti9Wj6P2i4SsK4bHRnzUKT8k/FGOUoPLZ7kYm8=" }, "Required" : "1", "Schema" : { "properties" : { "algorithm" : { "description" : "The TSIG algorithm. The mnemonics are a subset of those published in\nthe IANA registry at\n.\n", "enum" : [ "hmac-sha256", "hmac-sha384", "hmac-sha512" ], "type" : "string" }, "name" : { "description" : "The TSIG name.", "format" : "hostname", "type" : "string" }, "secret" : { "description" : "The TSIG secret, encoded in Base64.", "pattern" : "^[A-Za-z0-9\\+\\/]+=*$", "type" : "string" } }, "type" : "object" }, "Type" : "input" }, "dnssecOps.zskRolloverZone" : { "Description" : "The domain name which will be monitored for the occurrence of a ZSK\nrollover.\n\nThis value of this input parameter **MUST NOT** be the same as the values of\nthe `dnssecOps.kskRolloverZone` and `dnssecOps.algorithmRolloverZone`\nparameters.\n", "Example" : "example.com", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "epp.clid01" : { "Description" : "The username used to log in to the EPP server.", "Example" : "clid-01", "Required" : "1", "Schema" : { "maxLength" : "16", "minLength" : "3", "type" : "string" }, "Type" : "input" }, "epp.clid01DataModel" : { "Description" : "the data model configured for this registrar. This may be omitted and will\nin any case be ignored unless the value of the `general.registryDataModel`\ninput parameter is `per-registrar`.\n\n* A value of `minimum` means that this registrar does not need to specify a\n registrant object when creating a domain name.\n* A value of `maximum` means that this registrar **MUST** specify a\n registrant object when creating a domain name.\n\nIf the value of the `general.registryDataModel` input parameter is\n`per-registrar`, then the value of this input parameter **MUST** be\ndifferent from the value of the `epp.clid02DataModel` input parameter.\n", "Example" : "minimum", "Required" : "", "Schema" : { "enum" : [ "minimum", "maximum" ], "type" : "string" }, "Type" : "input" }, "epp.clid02" : { "Description" : "The username used for transfer tests.", "Example" : "clid-02", "Required" : "1", "Schema" : { "maxLength" : "16", "minLength" : "3", "type" : "string" }, "Type" : "input" }, "epp.clid02DataModel" : { "Description" : "the data model configured for this registrar. This may be omitted and will\nin any case be ignored unless the value of the `general.registryDataModel`\ninput parameter is `per-registrar`.\n\n* A value of `minimum` means that this registrar does not need to specify a\n registrant object when creating a domain name.\n* A value of `maximum` means that this registrar **MUST** specify a\n registrant object when creating a domain name.\n\nIf the value of the `general.registryDataModel` input parameter is\n`per-registrar`, then the value of this input parameter **MUST** be\ndifferent from the value of the `epp.clid01DataModel` input parameter.\n", "Example" : "minimum", "Required" : "", "Schema" : { "enum" : [ "minimum", "maximum" ], "type" : "string" }, "Type" : "input" }, "epp.hostModel" : { "Description" : "The host model supported by the EPP server. The possible values for this\nparameter are:\n * `objects`\n * `attributes`\n", "Example" : "objects", "Required" : "1", "Schema" : { "enum" : [ "objects", "attributes" ], "type" : "string" }, "Type" : "input" }, "epp.hostName" : { "Description" : "The fully-qualified domain name of the EPP server.\n\nThe server name **MUST** comply with the requirements for valid\nhostnames described in [RFC\n1123](https://www.rfc-editor.org/rfc/rfc1123.html), section 2.1.\nAdditionally, all IDN labels in the server name **MUST** comply with\nIDNA2008.\n", "Example" : "epp.rsp.tech", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "epp.loginExtension" : { "Description" : "An EPP `` element containing the extension elements(s) which are\nrequired to succesfully log in to the EPP server.\n\nThe XML namespace URI(s) of the child elements(s) of the ``\nelement **MUST** appear in `` elements in the ``, and the\nextension(s) **MUST** be registered in the [EPP Extension\nRegistry](https://www.iana.org/assignments/epp-extensions/epp-extensions.xhtml).\n\nIf no extensions are required, this input parameter **MUST** be omitted. If\nprovided, its content will not be validated until the test run occurs, and\nif found to be invalid, the `EPP_INVALID_EXTENSION` error will be emitted.\n\n**Note:** the RST v2.0 service natively supports the [Login\nSecurity extension (RFC\n8807)](https://www.rfc-editor.org/rfc/rfc8807.html). If your EPP server\nimplements this extension, you **MUST NOT** include it in this input\nparameter.\n", "Example" : "\n \n \n\n", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "epp.pwd01" : { "Description" : "The password used to log in to the EPP server.", "Example" : "foo2bar", "Required" : "1", "Schema" : { "minLength" : "6", "type" : "string" }, "Type" : "input" }, "epp.pwd02" : { "Description" : "The password used for transfer tests.", "Example" : "foo3bar", "Required" : "1", "Schema" : { "minLength" : "6", "type" : "string" }, "Type" : "input" }, "epp.registeredContacts" : { "Description" : "An array of contact IDs that exist in the EPP server and which are therefore\nunavailable for registration.\n\nIf the value of `general.registryDataModel` is `minimum`, this parameter\n**MUST** be omitted. Otherwise, at least two contact IDs **MUST** be\nprovided.\n", "Example" : [ "abc123", "def321" ], "Required" : "", "Schema" : { "items" : { "type" : "string" }, "minItems" : "2", "type" : "array" }, "Type" : "input" }, "epp.registeredNames" : { "Description" : "An array of domain names that exist in the EPP server and which are\ntherefore unavailable for registration. The domains **MUST NOT** be under\nthe sponsorship of the `epp.clid01` or `epp.clid02` registrars. The array\n**MUST** contain one member for each TLD in the TLD set.\n", "Example" : [ "example.example1", "example.example2" ], "Required" : "1", "Schema" : { "items" : { "format" : "hostname", "type" : "string" }, "type" : "array" }, "Type" : "input" }, "epp.registeredNameservers" : { "Description" : "An array of host objects that exist in the EPP server and which are\ntherefore unavailable for registration.\n\nIf the value of `epp.hostModel` is `objects`, for each TLD in the TLD set,\nthis array **MUST** contain one hostname which is subordinate to that TLD.\n\nHowever, if it is `attributes`, this parameter **MUST** be omitted.\n", "Example" : [ "ns1.example.example1", "ns2.example.example2" ], "Required" : "", "Schema" : { "items" : { "format" : "hostname", "type" : "string" }, "type" : "array" }, "Type" : "input" }, "epp.requiredContactElements" : { "Description" : "This input parameter is complementary to the `epp.supportedContactElements`\nparameter. It may be used to indicate those elements which are optional in\n[RFC 5733](https://www.rfc-editor.org/rfc/rfc5733.html) but are mandatory in\nthe server policy.\n\nAll elements that are listed in this parameter **MUST** also be listed in\nthe `epp.supportedContactElements` parameter.\n\nThis input parameter is an array of element tag names, optionally suffixed\nwith a colon (`:`) followed by an attribute name.\n\nIf the value of `general.registryDataModel` is `minimum`, this array `MUST`\nbe empty.\n", "Example" : [ "street", "voice" ], "Required" : "", "Schema" : { "items" : { "enum" : [ "org", "street", "sp", "pc", "voice", "voice:ext", "fax", "fax:ext" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "epp.requiredContactTypes" : { "Description" : "An array containing the values of the `type` attribute of ``\nelement(s) that are required to successfully create a domain name.\n\nIf the value of `general.registryDataModel` is `minimum`, this array `MUST`\nbe empty.\n", "Example" : [ "admin" ], "Required" : "1", "Schema" : { "items" : { "enum" : [ "admin", "tech", "billing" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "epp.secDNSInterfaces" : { "Description" : "Which of the interfaces defined in Section 4 of [RFC\n5910](https://www.rfc-editor.org/rfc/rfc5910.html) the server supports\n(either `dsData` or `keyData`).\n", "Example" : "dsData", "Required" : "1", "Schema" : { "enum" : [ "dsData", "keyData" ], "type" : "string" }, "Type" : "input" }, "epp.serverIssuedClientCertificate01" : { "Description" : "If the EPP server uses a private CA to issue client certificates, then\na certificate generated using the CSR provided in the `epp.client01CSR`\nresource may be provided using this parameter. This certificate will only be\nused in conjunction with the `epp.clid01` and `epp.pwd01` credentials. If\nthe server will accept ICANN's own client certificate, this parameter\n**MUST** be empty.\n", "Example" : "rst_test_client_cert.pem", "Required" : "", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*$", "type" : "string" }, "Type" : "file" }, "epp.serverIssuedClientCertificate02" : { "Description" : "If the EPP server uses a private CA to issue client certificates, then\na certificate generated using the CSR provided in the `epp.client02CSR`\nresource may be provided using this parameter. This certificate will only be\nused in conjunction with the `epp.clid02` and `epp.pwd02` credentials. If\nthe server will accept ICANN's own client certificate, this parameter\n**MUST** be omitted.\n", "Example" : "rst_test_client_cert.pem", "Required" : "", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*$", "type" : "string" }, "Type" : "file" }, "epp.supportedContactElements" : { "Description" : "In [RFC 5733](https://www.rfc-editor.org/rfc/rfc5733.html#section-3.2.1),\nthe mandatory elements that **MUST** be included in contact ``\ncommands are ``, ``, `` and ``. RFC 5733 also\nspecifies a set of optional elements. To comply with RFC 5733, EPP\nservers **MUST** accept and process the mandatory elements, but **MAY**\nreject commands that contain optional elements.\n\nThis input parameter should be used to indicate which of the optional\nelements the EPP server supports.\n\nIf a value contains a colon (`:`), then the first part is the element name\nand the second part is an attribute name.\n\nElements that are listed in this parameter **MAY** also be listed in the\n`epp.requiredContactElements` parameter.\n\nIf the value of `general.registryDataModel` is `minimum`, this array `MUST`\nbe empty.\n", "Example" : [ "org", "street", "sp", "pc", "voice", "voice:ext" ], "Required" : "1", "Schema" : { "items" : { "enum" : [ "org", "street", "sp", "pc", "voice", "voice:ext", "fax", "fax:ext" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "epp.supportedContactPostalInfoTypes" : { "Description" : "This input parameter may be used to indicate, if the server supports contact\nobjects, which values of the `type` attribute of ``\nelements are supported.\n\nA value of `both` indicates that both `int` and `loc` types are supported.\n", "Example" : "int", "Required" : "", "Schema" : { "enum" : [ "int", "loc", "both" ], "type" : "string" }, "Type" : "input" }, "general.registryDataModel" : { "Description" : "This input parameter describes the data model(s) supported by the registry,\ndetermined in accordance with Section 7 of the Registration Data Policy. The\npossible values are:\n\n* `minimum`: the registry does not collect registrant contact information\n from registrars. This policy applies to all registrars.\n* `maximum`: the registry requires the transmission of registrant contact\n information from registrars for all registrations. This policy applies to\n all registrars.\n* `per-registrar`: the registry may or may not require transmission of\n registrant contact information, depending on whether there is an\n appropriate legal basis, and a data processing agreement is in place\n between the registry operator and the registrar. Therefore, the data model\n is determined per-registrar rather than globally.\n\nIf the value of this parameter is `per-registrar`, then one of the registrar\naccounts specified by the `epp.clid01` and `epp.clid02` input parameters\n**MUST** be configured to use the minimum data model, and one **MUST** be\nconfigured to use the maximum data model. The `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters are used to identify the data model\nconfigured for each account.\n", "Example" : "minimum", "Required" : "1", "Schema" : { "enum" : [ "minimum", "maximum", "per-registrar" ], "type" : "string" }, "Type" : "input" }, "idn.domainCreateExtension" : { "Description" : "An EPP `` element containing the extension elements(s) which are\nrequired to succesfully perform a `` command for an IDN domain.\n\nThe special token `` will (if present) be replaced with the\nlanguage tag of the domain being created.\n\nThe XML namespace URI(s) of the child elements(s) of the ``\nelement **MUST** appear in `` elements in the ``, and the\nextension(s) **MUST** be registered in the [EPP Extension\nRegistry](https://www.iana.org/assignments/epp-extensions/epp-extensions.xhtml).\n\nIf no extensions are required, this input parameter **MUST** be omitted. If\nprovided, its content will not be validated until the test run occurs, and\nif found to be invalid, `EPP_INVALID_IDN_EXTENSION` error will be emitted.\n", "Example" : "\n \n \n \n \n\n", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "integration.rdeSFTPDirectory" : { "Description" : "The directory on the SFTP server where deposit files may be found.\n", "Example" : "/path/to/deposits", "Required" : "1", "Schema" : { "minLength" : "1", "pattern" : "^[^\\0]+$", "type" : "string" }, "Type" : "input" }, "integration.rdeSFTPHostname" : { "Description" : "The hostname of the operator's SFTP server.", "Example" : "sftp.rsp.tech", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "integration.rdeSFTPUsername" : { "Description" : "The username that can be used to connect to the SFTP server.", "Example" : "icann", "Required" : "1", "Schema" : { "minLength" : "1", "type" : "string" }, "Type" : "input" }, "minimumRPMS.claimsTLD" : { "Description" : "A TLD, or other registry-class zone, which has been configured to be in\nperpetual trademark claims.\n", "Example" : "tmclaims.rsp.tech", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "minimumRPMS.sunriseModel" : { "Description" : "The sunrise models supported by the EPP server. The possible values for\nthis parameter are:\n\n * `start-date`\n * `end-date`\n\n These models are explained in Section 2 of the [Trademark Clearinghouse -\n Rights Protection Mechanism\n Requirements](https://newgtlds.icann.org/sites/default/files/rpm-requirements-14may14-en.pdf)\n (PDF).\n", "Example" : "start-date", "Required" : "1", "Schema" : { "enum" : [ "start-date", "end-date" ], "type" : "string" }, "Type" : "input" }, "minimumRPMS.sunriseTLD" : { "Description" : "A TLD, or other registry-class zone, which has been configured to be in\nperpetual sunrise.\n", "Example" : "tmclaims.rsp.tech", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "rdap.baseURLs" : { "Description" : "The RDAP base URL(s) for the TLD(s). A base URL **MUST** be provided for\neach TLD being tested.\n\nThe host name component of each URL **MUST** comply with the requirements\nfor valid hostnames described in [RFC\n1123](https://www.rfc-editor.org/rfc/rfc1123.html), section 2.1.\nAdditionally, all IDN labels in the host name **MUST** comply with IDNA2008.\n", "Example" : [ { "baseURL" : "https://rdap.example.com/example/", "tld" : "example" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "baseURL" : { "description" : "The RDAP Base URL. The URL **MUST** have trailing slash (`/`). If\nspecified, the port **MUST** be 443.\n", "format" : "url", "pattern" : ".+/$", "type" : "string" }, "tld" : { "description" : "The TLD or equivalent registry-class domain name.", "format" : "hostname", "type" : "string" } }, "required" : [ "tld", "baseURL" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "rdap.profileVersion" : { "Description" : "The version of the gTLD RDAP Profile that is supported. For more information\nplease see .\n\nFrom 2025-08-21 onwards, gTLD registries **MUST** implement the\nFebruary-2024 version of the gTLD RDAP profile.\n", "Example" : "february-2024", "Required" : "1", "Schema" : { "enum" : [ "february-2024" ], "type" : "string" }, "Type" : "input" }, "rdap.testDomains" : { "Description" : "The domain(s) that will be queried to validate domain responses. This\ninput parameter is an array of domain names, which **MUST** include at least\none domain name for each TLD being tested.\n", "Example" : [ { "name" : "example.example", "tld" : "example" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "name" : { "description" : "The domain name.", "format" : "hostname", "type" : "string" }, "tld" : { "description" : "The TLD or equivalent registry-class domain name.", "format" : "hostname", "type" : "string" } }, "required" : [ "tld", "name" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "rdap.testEntities" : { "Description" : "The entities(s) that will be queried to validate entity responses. This\ninput parameter is an array of objects. At least one entity **MUST** be\nprovided for each TLD being tested.\n", "Example" : [ { "handle" : "9995", "tld" : "example" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "handle" : { "description" : "the entity handle.", "type" : "string" }, "tld" : { "description" : "The TLD.", "format" : "hostname", "type" : "string" } }, "required" : [ "tld", "handle" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "rdap.testNameservers" : { "Description" : "The nameservers(s) that will be queried to validate nameserver responses.\nThis input parameter is an array of objects. At least one nameserver\n**MUST** be provided for each TLD being tested.\n", "Example" : [ { "nameserver" : "ns1.example.com", "tld" : "example1" }, { "nameserver" : "ns1.example.com", "tld" : "example2" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "nameserver" : { "description" : "The nameserver name.", "format" : "hostname", "type" : "string" }, "tld" : { "description" : "The TLD.", "format" : "hostname", "type" : "string" } }, "required" : [ "tld", "nameserver" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "rde.depositFile" : { "Description" : "An RDE deposit file. The TLD to which the deposit relates **MUST** match\none of the TLDs that are associated with the test object.\n", "Example" : "example_2023-10-04_full_S1_R0.ryde", "Required" : "1", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*\\.ryde$", "type" : "string" }, "Type" : "file" }, "rde.publicKey" : { "Description" : "A PGP public key block.\n", "Example" : "rsp-rde-signing-key.asc", "Required" : "1", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*\\.asc$", "type" : "string" }, "Type" : "file" }, "rde.signatureFile" : { "Description" : "An ASCII-armoured OpenPGP signature covering the deposit file.\n", "Example" : "example_2023-10-04_full_S1_R0.sig", "Required" : "1", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*\\.sig$", "type" : "string" }, "Type" : "file" }, "srsgw.domainCreateExtension" : { "Description" : "If a domain `` command submitted through the SRS Gateway requires\none or more extension in its `` element in order to succeed, then\nthis parameter can be used to provide the XML syntax that should be used.\n\nThis parameter should contain a valid EPP `` element containing\nall the extension elements that are required for the domain ``\ncommand. This element will be imported into the domain `` command\nframe before being sent to the server.\n\nThe XML namespace URIs of the child elements of the `` element\n**MUST** appear in `` elements in the `` and the\nextensions **MUST** be registered in the\n[EPP Extension Registry](https://www.iana.org/assignments/epp-extensions/epp-extensions.xhtml).\n\nIf no extensions are required, this input parameter **MUST** be omitted. If\nprovided, it will not be validated until the test run occurs, at which point\nan `SRSGW_EPP_INVALID_EXTENSION` error will be emitted.\n", "Example" : "\n \n abc123\n \n\n", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.domainDeleteExtension" : { "Description" : "This input parameter is used to provide the extension elements required to\nperform a domain `` command through the SRS Gateway. Other than the\ndifferent EPP command it relates to, it is identical to the\n`srsgw.domainCreateExtension` element.\n", "Example" : "", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.domainRenewExtension" : { "Description" : "This input parameter is used to provide the extension elements required to\nperform a domain `` command through the SRS Gateway. Other than the\ndifferent EPP command it relates to, it is identical to the\n`srsgw.domainCreateExtension` element.\n", "Example" : "", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.domainTransferApproveExtension" : { "Description" : "This input parameter is used to provide the extension elements required to\nperform a domain `` command through the SRS Gateway.\nOther than the different EPP command it relates to, it is\nidentical to the `srsgw.domainCreateExtension` element.\n", "Example" : "", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.domainTransferRequestExtension" : { "Description" : "This input parameter is used to provide the extension elements required to\nperform a domain `` command through the SRS Gateway.\nOther than the different EPP command it relates to, it is\nidentical to the `srsgw.domainCreateExtension` element.\n", "Example" : "", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.eppClid01" : { "Description" : "The username used to log in to the SRS Gateway EPP server. This username\nmust correspond to the same entity as that of the `epp.clid01` input\nparameter.\n", "Example" : "clid-01", "Required" : "1", "Schema" : { "maxLength" : "16", "minLength" : "3", "type" : "string" }, "Type" : "input" }, "srsgw.eppClid01DataModel" : { "Description" : "The data model for the `srsgw.eppClid01` client. This may be omitted and\nwill in any case be ignored unless the value of the\n`srsgw.registryDataModel` input parameter is `per-registrar`.\n\nIf set, then the value of this input parameter **MUST** be different from\nthe value of the `srsgw.eppClid02DataModel` input parameter.\n", "Example" : "minimum", "Required" : "", "Schema" : { "enum" : [ "minimum", "maximum" ], "type" : "string" }, "Type" : "input" }, "srsgw.eppClid02" : { "Description" : "The username used for transfer tests.", "Example" : "clid-02", "Required" : "1", "Schema" : { "maxLength" : "16", "minLength" : "3", "type" : "string" }, "Type" : "input" }, "srsgw.eppClid02DataModel" : { "Description" : "The data model for the `srsgw.eppClid02` client. This may be omitted and\nwill in any case be ignored unless the value of the\n`srsgw.registryDataModel` input parameter is `per-registrar`.\n\nIf set, then the value of this input parameter **MUST** be different from\nthe value of the `srsgw.eppClid01DataModel` input parameter.\n", "Example" : "minimum", "Required" : "", "Schema" : { "enum" : [ "minimum", "maximum" ], "type" : "string" }, "Type" : "input" }, "srsgw.eppHostName" : { "Description" : "The fully-qualified domain name of the SRS Gateway EPP server.", "Example" : "epp.rsp.tech", "Required" : "1", "Schema" : { "format" : "hostname", "type" : "string" }, "Type" : "input" }, "srsgw.eppPwd01" : { "Description" : "The username used to log in to the SRS Gateway EPP server. This username\nmust correspond to the same entity as that of the `epp.clid02` input\nparameter.\n", "Example" : "foo2bar", "Required" : "1", "Schema" : { "minLength" : "6", "type" : "string" }, "Type" : "input" }, "srsgw.eppPwd02" : { "Description" : "The password used for transfer tests.", "Example" : "foo3bar", "Required" : "1", "Schema" : { "minLength" : "6", "type" : "string" }, "Type" : "input" }, "srsgw.eppRequiredContactElements" : { "Description" : "This input parameter has the same semantics as the\n`epp.requiredContactElements` input parameter but relates to the SRS Gateway\nEPP Server.\n", "Example" : [ "org", "street", "sp", "pc", "voice", "voice:ext" ], "Required" : "1", "Schema" : { "items" : { "enum" : [ "org", "street", "sp", "pc", "voice", "voice:ext", "fax", "fax:ext" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "srsgw.eppRequiredContactTypes" : { "Description" : "This input parameter has the same semantics as the\n`epp.requiredContactTypes` input parameter but relates to the SRS Gateway\nEPP Server.\n", "Example" : [ "admin" ], "Required" : "1", "Schema" : { "items" : { "enum" : [ "admin", "tech", "billing" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "srsgw.eppSupportedContactElements" : { "Description" : "This input parameter has the same semantics as the\n`epp.supportedContactElements` input parameter but relates to the SRS Gateway\nEPP Server.\n", "Example" : [ "org", "street", "sp", "pc", "voice", "voice:ext" ], "Required" : "", "Schema" : { "items" : { "enum" : [ "org", "street", "sp", "pc", "voice", "voice:ext", "fax", "fax:ext" ], "type" : "string" }, "type" : "array" }, "Type" : "input" }, "srsgw.loginExtension" : { "Description" : "An EPP `` element containing the extension elements(s) which are\nrequired to succesfully log in to the EPP server.\n\nThe XML namespace URI(s) of the child elements(s) of the ``\nelement **MUST** appear in `` elements in the ``, and the\nextension(s) **MUST** be registered in the [EPP Extension\nRegistry](https://www.iana.org/assignments/epp-extensions/epp-extensions.xhtml).\n\nIf no extensions are required, this input parameter **MUST** be omitted. If\nprovided, its content will not be validated until the test run occurs, and\nif found to be invalid, the `SRSGW_EPP_INVALID_EXTENSION` error will be\nemitted.\n\n**Note:** the RST v2.0 service natively supports the [Login\nSecurity extension (RFC\n8807)](https://www.rfc-editor.org/rfc/rfc8807.html). If your EPP server\nimplements this extension, you **MUST NOT** include it in this input\nparameter.\n", "Example" : "\n \n \n\n", "Required" : "", "Schema" : { "type" : "string" }, "Type" : "input" }, "srsgw.rdapBaseURLs" : { "Description" : "The RDAP base URL(s) for the TLD(s).\n\nThe host name component of each URL **MUST** comply with the requirements\nfor valid hostnames described in [RFC\n1123](https://www.rfc-editor.org/rfc/rfc1123.html), section 2.1.\nAdditionally, all IDN labels in the host name **MUST** comply with IDNA2008.\n\nIf an RDAP Base URL includes a port, it **MUST** be 443.\n", "Example" : [ { "baseURL" : "https://rdap.example.com/example/", "tld" : "example" } ], "Required" : "1", "Schema" : { "items" : { "properties" : { "baseURL" : { "description" : "The RDAP Base URL. The URL **MUST** have trailing slash (`/`).\n", "format" : "url", "pattern" : ".+/$", "type" : "string" }, "tld" : { "description" : "The TLD or equivalent registry-class domain name.", "format" : "hostname", "type" : "string" } }, "required" : [ "tld", "baseURL" ], "type" : "object" }, "minItems" : "1", "type" : "array" }, "Type" : "input" }, "srsgw.registryDataModel" : { "Description" : "This input parameter identifies the data model for the SRS Gateway, which\nmay be different to that of the Primary EPP server (for example, because the\nGateway requires registrant information in order to verify their identity).\n\nIt has identical semantics to the `general.registryDataModel` input\nparameter.\n", "Example" : "minimum", "Required" : "1", "Schema" : { "enum" : [ "minimum", "maximum", "per-registrar" ], "type" : "string" }, "Type" : "input" }, "srsgw.serverIssuedClientCertificate01" : { "Description" : "If the EPP server uses a private CA to issue client certificates, then\na certificate generated using the CSR provided in the `epp.client01CSR` may\nbe provided using this parameter. This certificate will only be used in\nconjunction with the `srsgw.eppClid01` and `srsgw.eppPwd01` credentials.\nIf the server will accept ICANN's own client certificate, this parameter\n**SHOULD** be omitted.\n", "Example" : "cert.pem", "Required" : "", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*$", "type" : "string" }, "Type" : "file" }, "srsgw.serverIssuedClientCertificate02" : { "Description" : "If the EPP server uses a private CA to issue client certificates, then\na certificate generated using the CSR provided in the `epp.client02CSR` may\nbe provided using this parameter. This certificate will only be used in\nconjunction with the `srsgw.eppClid02` and `srsgw.eppPwd02` credentials.\nIf the server will accept ICANN's own client certificate, this parameter\n**SHOULD** be omitted.\n", "Example" : "cert.pem", "Required" : "", "Schema" : { "pattern" : "^[^\\.\\/\\0][^\\/\\0]*$", "type" : "string" }, "Type" : "file" } }, "Last-Updated" : "2026-05-06", "Preamble" : "This file describes each test [plan](#test-plans), [suite](#test-suites) and\n[case](#test-cases) in the RST service, as well as the\n[input parameters](#input-parameters) required for each; relevant\n[resources](#resources); [data providers](#data-providers); and the [errors](#errors) that may occur during testing.\n\nThe key words \"MUST\", \"MUST NOT\", \"REQUIRED\", \"SHALL\", \"SHALL NOT\", \"SHOULD\",\n\"SHOULD NOT\", \"RECOMMENDED\", \"NOT RECOMMENDED\", \"MAY\", and \"OPTIONAL\" in this\ndocument are to be interpreted as described in [RFC\n2119](https://www.rfc-editor.org/rfc/rfc2119.html) when, and only when, they\nappear in all capitals, as shown here.\n\n# 2.1. Test plans\n\nAn individual *Test Plan* addresses a particular scenario, for example, RSP\nevaluation, or Pre-Delegation Testing. Each plan consists of one or more *test\nsuites*, which in turn include one or more *test cases*.\n\n## 2.1.1. Test plan types\n\nThere are two types of test plan described in this document:\n\n* **\"Business as usual\"** plans, which are used as part of the lifecycle of a\n gTLD (e.g., Pre-Delegation Test, RSP/DNS RSP change Test, IDN Test, SRS\n Gateway Test);\n\n* **RSP evaluation** plans, which are used as part of the [RSP evaluation\n program](https://newgtldprogram.icann.org/en/application-rounds/round2/rsp).\n\n# 2.2. Test suites\n\nA *Test Suite* is a collection of *test cases*, that have a common theme or\nsubject matter, for example, **Authoritative DNS**, or **Registry Data Escrow**.\n\n# 2.3. Test cases\n\nA *Test Case* describes a process for determining the conformance or\nacceptability of a certain element of the system.\n\nA test case consists of a *test procedure* that accepts zero or more **input\nparameters**, and generates one or more **test results**.\n\n## 2.3.1. Input parameters\n\nAll test cases require some information about the subject of the test, for\nexample, service hostnames, credentials, and functional parameters. These\n*input parameters* may be shared across multiple test cases.\n\n## 2.3.2. Data providers\n\nSome test cases involve performing multiple operations (such as creating\nobjects) using slightly different input values each time, in order to test the\nbehaviour of a system and its ability to validate inputs. To simplify\nimplementation and provide clarity for test subjects, *data providers* are used\nto enumerate all the possible permutations of input values. A data provider\nconsists of sets of input values, plus the expected outcome, and the error code\nthat should be raised if the outcome does not match the expected outcome.\n\n## 2.3.3. Resources\n\nA *resource* is a file or other set of information that may assist a test\nsubject in preparing for a test. For example, it might be a list of IP addresses\nfrom which network connections will be initiated, or the public keys used for\nencryption and authentication.\n\nEach resource has a description and one or more URLs. Some resources have\ndifferent contents in the OT&E or Production environments, where this is the\ncase, a URL for each environment will be listed.\n\n## 2.3.4. Test environments\n\nEach test plan indicates whether the test is to be carried out in the\nproduction environment, or whether a test, staging or Operational Testing and\nEvaluation (OT&E) environment may be used. In general, test plans which are\ndesigned for \"business as usual\" use during the lifecycle of a TLD **MUST** be\ncarried out in the production registry infrastructure, while RSP evaluation\ntests **MAY** be carried out in a test, staging, OT&E, or other environment.\n\n## 2.3.5. Test results\n\nTest cases will generate one or more *test results*. Test results indicate the\noutcome of the test and other relevant information.\n\n## 2.3.6. General pass/fail criteria\n\nIn general, for a test to pass, **all** the test cases specified in the test\nsuite(s) for the test plan **MUST** pass: if *any* fail, then the test as a\nwhole will fail.\n\nA test case will fail if it produces one or more [errors](#errors) with the\n`ERROR` or `CRITICAL` severities.\n\n## 2.3.7. Error severity levels\n\nThe supported severity levels are a subset of the values defined in [RFC\n5424](https://www.rfc-editor.org/rfc/rfc5424.html).\n\n1. `INFO`: useful diagnostic messages that provide context and explain what is\n happening, or expected.\n2. `WARNING`: an issue which does not prevent the test case from *passing*, but\n which may benefit from further investigation.\n3. `ERROR`: an issue which prevents the test case from *passing*, but does not\n prevent the test case from *continuing*. A test case may produce multiple\n `ERROR` results. Each `ERROR` error result will have an associated error\n code.\n4. `CRITICAL`: an issue which prevents the test suite from continuing any\n further. A test case will only produce a single `CRITICAL` result and it will\n always be the last result in the log. Each `CRITICAL` error result will have\n an associated error code.\n\n# 2.4. Test procedures\n\nWhere possible, test cases will reuse existing connections and any objects\ncreated as part of previous test cases, to reduce the resources required to\nperform service testing. However, it is anticipated that registry services will\nsee a moderate volume of connections from test systems, and a moderate number of\nobjects may be created as part of the test. The level of resource consumption is\nanticipated to be significantly lower than that experienced by a live production\nsystem, so in \"business as usual\" scenarios, where production systems are being\ntested, no impact to those systems is expected.\n\nWhere a test is being carried out using test, staging or OT&E environments, then\nthose systems should be provisioned with sufficient capacity to allow testing to\nbe carried out without interruption. Any existing OT&E environment supporting\nregistrar integration testing and onboarding is likely to be sufficiently robust\nto support Registry System Testing with no further additional capacity\nrequirements.\n\n# 2.5. Test sequence\n\nThe test system will generate a linear _test sequence_ based on the\ntest suite(s) and test case(s) used by the specified test plan. The test cases\nwill be sorted in canonical alphanumeric order and executed in that order.\n\nIf a test case produces a `CRITICAL` message, the test run will stop at that\npoint.\n\nFuture versions may optimize the test sequence using knowledge of intercase\ndependencies to allow certain parts of the sequence to be run in parallel.\n\n# 2.6. Test TLDs for RSP Evaluation\n\nRSP evaluation tests do not use existing or applied-for TLDs; instead, a unique\nTLD label will be defined for each test, based on the application type and a\nunique number. These TLD labels will take the form:\n\n```\nzz--[type]-[number]\n```\n\nWhere `[type]` will be replaced with the application type. For example, a\n`MainRSPEvaluationTest` test for a Main RSP application will use a TLD of the\nform `.zz--main-1234`. Test subjects will need to configure their registry\nsystems to support this TLD prior to requesting a test run.\n\n# 2.7. External TLDs\n\nThe RST system will sometimes generate domain and host names that must, for\nsecurity and stability reasons, be guaranteed to not exist in the global DNS.\n\nTo ensure this, the `.icann` top-level domain will be used as the parent TLD\nfor such domain and host names. This TLD has been selected because (1) it will\nnever be delegated in the DNS and (b) unlike `.invalid`, `.internal` etc,\nthere is no expectation that special processing should take place for it.\n\nRegistry operators whose implementations validate the existence of the parent\nTLD of a nameserver name should update their implementation to exceptionally\nallow the use of `.icann` during RST tests.\n\n# 2.8. Extensible Provisioning Protocol (EPP) Repository Identifiers\n\nEPP servers **MUST** use unique repository identifiers that are registered in the\n[EPP Repository ID\nregistry](https://www.iana.org/assignments/epp-repository-ids/epp-repository-ids.xhtml)\n(see [Section 2.8 of RFC 5730](https://www.rfc-editor.org/rfc/rfc5730.html#section-2.8)).\n\nThe special ID `ICANNRST` (`#x0049 #x0043 #x0041\n#x004e #x004e #x0052 #x0053 #x0054`) has been registered by ICANN and **MAY** be\nused by EPP and RDAP servers during RSP evaluation tests if the test subject\ndoes not have an existing repository ID that is appropriate for this purpose.\nHowever, for pre- and post-delegation tests of production registry systems, this\nrepository ID **MUST NOT** be used.\n\n# 2.9. EPP extensions\n\nThe EPP test suite requires that servers implement certain EPP extensions, as\ndescribed in the `epp-02` test case. Test cases in the EPP test suite\nascertain whether these extensions are properly implemented in the server.\n\nSome EPP servers may require EPP clients to include additional extension\nelements in the EPP commands that take place during a run of the EPP test suite.\nBecause it is not feasible to natively implement support for all such\nextensions, the EPP test suite includes input parameters which allow test\nsubjects to provide the extension element(s) which must be included in EPP\ncommands.\n\nThese input parameters **MUST** contain a single EPP `` element which\ncontains the element(s) required for the particular EPP command to which the\ninput parameter relates. These element(s) **MUST** validate against the relevant\nXML schema.\n\nIf no extensions are required for a particular command, then the corresponding\ninput parameter **MUST** be omitted. If provided, it will not be validated until\nthe test run occurs, at which point an error code will be generated if it is\ninvalid.\n\nAll EPP extensions used by the EPP server **MUST** be registered in the EPP\nExtension Registry, as described in the `epp-02` test case.\n\nOther test suites which use the EPP server (i.e. the IDN, Minimum RPMs,\nIntegration and SRS Gateway suites) will also use the input parameters from the\nEPP suite, if provided.\n\n# 2.10. Key acronyms and terms\n\nRST\n: Registry System Testing. This system.\n\nPDT\n: Pre-Delegation Test. A test carried out prior to the delegation of a new TLD\ninto the DNS root zone.\n\nRSP\n: Registry Service Provider. A specialist provider of critical registry\nservices.\n\nDNS\n: Domain Name System. The Internet's system of globally unique identifiers.\n\nTLD\n: Top-level domain. The highest level of the DNS namespace hierarchy.\n\ngTLD\n: generic top-level domain.\n\nDNSSEC\n: DNS Security Extensions. DNSSEC is described in [BCP\n237](https://www.rfc-editor.org/info/bcp237).\n\nEPP\n: Extensible Provisioning Protocol. The protocol used by registrars to create\nand manage domain name registrations in an SRS. EPP is defined in [STD\n69](https://www.rfc-editor.org/info/std69).\n\nSRS\n: Shared Registry System. A TLD registry in which registrations are managed\nby one or more registrars, using EPP.\n\nRDDS\n: Registration Data Directory Services. A service to provide access to\ndata about domain registrations to third parties.\n\nRDAP\n: Registration Data Access Protocol. The protocol used to deliver the RDDS.\nRDAP is defined in [STD 95](https://www.rfc-editor.org/info/std95).\n\nRDE\n: Registry Data Escrow. A system whereby the registration data stored in a\nShared Registry System is backed up to a trusted third party. RDE is defined\nin [RFC 8909](https://www.rfc-editor.org/info/rfc8909) and [RFC\n9022](https://www.rfc-editor.org/info/rfc9022).\n\nIDN\n: Internationalized Domain Name. A domain name that contains characters not in\nthe ASCII character set. The technical specification for IDNs may be found in\n[RFC 5890](https://www.rfc-editor.org/info/rfc5890). All gTLDs must comply\nwith ICANN's [IDN\nGuidelines](https://www.icann.org/resources/pages/implementation-guidelines-2012-02-25-en).\n\nLGR\n: Label Generation Ruleset. The rules by which IDNs are validated. LGRs are\ndescribed in [RFC 7940](https://www.rfc-editor.org/info/rfc7940).\n\nRO\n: Registry Operator. The entity to which ICANN has granted the right to\noperate a gTLD.\n\nRA\n: Registry Agreement. The contract between a Registry Operator and ICANN. The\nbase Registry Agreement may be reviewed at\n.\n\nKSK\n: Key Signing Key. A cryptographic key that serves as the Secure Entry Point\nfor a DNS zone, and which signs a DNS zone's ZSKs. A digest of this key is\npublished in the parent zone (ie. the root zone for a TLD).\n\nZSK\n: Zone Signing Key. A cryptographic key that signs a DNS zone's resource\nrecords.\n\nCSK\n: Combined Signing Key. A cryptographic key used as **both** a KSK and a ZSK.\n\nRPMs\n: Rights Protection Mechanisms, intended to discourage or prevent registration\nof domain names that violate or abuse another party’s legal rights. These\n**MUST** include (but are not limited to): (1) Sunrise Periods, and (2)\nTrademark Claims Periods (see [Specification 7 of the Registry\nAgreement](https://itp.cdn.icann.org/en/files/registry-agreements/base-registry-agreement-30-04-2023-en.html#specification7)).\n\nTMCH\n: Trademark Clearinghouse. The system used by ICANN to maintain a database of\nvalidated and registered trademarks which is used to enforce Rights Protection\nMechanisms (RPMs) in gTLDs. The functional specifications of the TMCH are\ndefined in [RFC 9361](https://www.rfc-editor.org/info/rfc9361).\n\nSLA\n: Service Level Agreement. The registry performance specifications laid out in\n[Specification 10 of the Registry\nAgreement](https://itp.cdn.icann.org/en/files/registry-agreements/base-registry-agreement-30-04-2023-en.html#specification10).\n\nRRI\n: Registration Reporting Interfaces. The interfaces provided by ICANN to\ncontracted parties including Registry Operators to fulfill and monitor their\napplicable reporting requirements, including per-registrar transaction\nreports; registry functions activity reports; data escrow deposits reports and\ndata escrow deposits notifications. For registry operators, the relevant\ninterfaces are defined in [draft-lozano-icann-registry-interfaces](https://datatracker.ietf.org/doc/html/draft-lozano-icann-registry-interfaces).\n", "RST-Test-Plan-Schema-Version" : "1.14.0", "Resources" : { "dnssecOps.xfrACL" : { "Description" : "A list of IPv4 and IPv6 address(es) or CIDR prefixes from which zone file\ntransfers to primary DNS servers will be made. The list is a plain text file\nwith each entry on a separate line.\n", "URL" : "https://rst-api.icann.org/v1/resource/dnssecOps.xfrACL.txt" }, "epp.client01CSR" : { "Description" : "For servers that operate a private CA, this CSR may be used to issue a\nclient certificate for the clients identified by the\n`epp.clid01` and `srsgw.eppClid01` input parameters.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client01CSR.pem" }, "epp.client01Certificate" : { "Description" : "[RFC 5734](https://www.rfc-editor.org/rfc/rfc5734.html) requires servers to\nperform authentication of clients by means of a client certificate.\n\nOperators that do not use a private CA **MUST** configure their systems to\npermit the client identified in the `epp.clid01` and `srsgw.eppClid01` input\nparameters to connect using the certificate found at this URL.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client01Certificate.pem" }, "epp.client01ChainCert" : { "Description" : "This resource contains the intermediate certificate used to sign the\ncertificate in the `epp.client01Certificate` resource. Some servers may need\nthis certificate in order to establish a chain of trust to the CA root\ncertificate.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client01ChainCert.pem" }, "epp.client02CSR" : { "Description" : "For servers that operate a private CA, this CSR may be used to issue a\nclient certificate for the clients identified by the\n`epp.clid02` and `srsgw.eppClid02` input parameters.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client02CSR.pem" }, "epp.client02Certificate" : { "Description" : "[RFC 5734](https://www.rfc-editor.org/rfc/rfc5734.html) requires servers to\nperform authentication of clients by means of a client certificate.\n\nOperators that do not use a private CA **MUST** configure their systems to\npermit the client identified in the `epp.clid02` and `srsgw.eppClid02` input\nparameters to connect using the certificate found at this URL.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client02Certificate.pem" }, "epp.client02ChainCert" : { "Description" : "This resource contains the intermediate certificate used to sign the\ncertificate in the `epp.client02Certificate` resource. Some servers may need\nthis certificate in order to establish a chain of trust to the CA root\ncertificate.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.client02ChainCert.pem" }, "epp.clientACL" : { "Description" : "A list of IPv4 and IPv6 address(es) or CIDR prefixes from which client\nconnections to the operator's EPP server will be made. The list is a plain\ntext file with each entry on a separate line.\n", "URL" : "https://rst-api.icann.org/v1/resource/epp.clientACL.txt" }, "epp.tlsCertificateStore" : { "Description" : "A PEM-formatted file containing the CA certificates trusted by Mozilla.\nFor more information, see .\n\nEPP servers **MUST** use a certificate that has a chain of trust to one of\nthe CAs present in this file.\n", "URL" : "https://curl.se/ca/cacert.pem" }, "idn.testLabelsForOTE" : { "Description" : "Test cases in the IDN test suite require a set of test labels which are used\nto compute domain names used in EPP `` commands. These test labels\nare provided when IDN table objects are created through the API.\n\nIn production, these objects will be created by ICANN org, but for OT&E,\ntest subjects must create IDN table objects themselves, and must therefore\nprovide test labels.\n\nTest subjects are free to submit any test labels they wish, but in order to\nproperly simulate a production test, the same set of labels should be used.\n\nThis resource is a zip file containing JSON files, each of which contains\nthe test labels for the [Second-Level Reference\nLGR](https://www.icann.org/resources/pages/second-level-lgr-2015-06-21-en)\nidentified by the script or language tag in the file name. The JSON files\nconform to the `idnTableRequest` object type from the [RST-API\nspecification](https://icann.github.io/rst-api-spec/).\n\nFor more information, see .\n", "URL" : "https://github.com/icann/rst-idn-test-labels/releases/download/v1.0.9/rst-idn-test-labels.zip" }, "integration.rdeSFTPACL" : { "Description" : "A list of IPv4 and IPv6 address(es) or CIDR prefixes from which client\nconnections to the operator's SFTP server will be made. The list is a plain\ntext file with each entry on a separate line.\n", "URL" : "https://rst-api.icann.org/v1/resource/integration.rdeSFTPACL.txt" }, "integration.rdeSFTPPublicKey" : { "Description" : "The SSH public key that will be used to authenticate connections to the\noperator's SFTP server.\n", "URL" : "https://rst-api.icann.org/v1/resource/integration.rdeSFTPPublicKey.txt" }, "rdap.clientACL" : { "Description" : "A list of IPv4 and IPv6 address(es) or CIDR prefixes from which client\nconnections to the operator's RDAP server will be made. The list is a plain\ntext file with each entry on a separate line.\n", "URL" : "https://rst-api.icann.org/v1/resource/rdap.clientACL.txt" }, "rde.encryptionKey" : { "Description" : "RDE deposit files **MUST** be encrypted using OpenPGP ([RFC\n4880](https://www.rfc-editor.org/rfc/rfc4880.html)). The PGP key that\n**MUST** be used to encrypt the escrow deposit file may be found at this\nURL.\n", "URL" : "https://rst-api.icann.org/v1/resource/rde.encryptionKey.asc" }, "tmch.testCRL" : { "Description" : "A Certificate Revocation List (CRL) that identifies revoked TMCH\ncertificates.\n", "URL" : "http://crl.icann.org/tmch_pilot.crl" }, "tmch.testCert" : { "Description" : "The x509 certificate that is the trust anchor for the test TMCH system. This\ncertificate can be used to validate the digital signatures on SMD files.\n", "URL" : "https://ca.icann.org/tmch_pilot.crt" }, "tmch.testDNL" : { "Description" : "A file containing the list of labels subject to Trademark Claims in the\nTMCH test environment.\n", "URL" : "https://rst-api.icann.org/v1/resource/tmch.testDNL.csv" }, "tmch.testSMDRL" : { "Description" : "A CSV file containing a list of revoked SMDs.\n", "URL" : "https://newgtlds.icann.org/en/about/trademark-clearinghouse/smd-test-revocation-22nov22-en.csv" }, "tmch.testSURL" : { "Description" : "A CSV file containing the list of labels for which SMDs have been produced\nin the TMCH test environment.\n", "URL" : "https://rst-api.icann.org/v1/resource/tmch.testSURL.csv" } }, "Test-Cases" : { "dns-address01" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html).\n\n# Objective\n\nIn order for the domain and its resources to be accessible, authoritative\nname servers must have addresses in the reachable public addressing space.\n\nIANA is responsible for global coordination of the IP addressing system.\nAside its address allocation activities, it maintains reserved address ranges\nfor special uses. These ranges can be categorized into two types:\n[Special purpose IPv4 addresses] and [Special purpose IPv6 addresses].\n\nThis test checks the name server IP addresses, both those derived from delegation and those\nderived from the name servers listed in the zone (NS records). Each address is compared against\nthe IANA databases. If an address is not globally reachable, a message is outputted.\n\n\n[A01_ADDR_NOT_GLOBALLY_REACHABLE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[A01_DOCUMENTATION_ADDR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[A01_GLOBALLY_REACHABLE_ADDR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[A01_LOCAL_USE_ADDR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[A01_NO_GLOBALLY_REACHABLE_ADDR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[A01_NO_NAME_SERVERS_FOUND]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address01.html#summary\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[Get-Del-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-delegation-ns-names-and-ip-addresses\n[Get-Zone-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-zone-ns-names-and-ip-addresses\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Special purpose IPv4 addresses]: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xml\n[Special purpose IPv6 addresses]: https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xml\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_A01_ADDR_NOT_GLOBALLY_REACHABLE", "ZM_A01_DOCUMENTATION_ADDR", "ZM_A01_LOCAL_USE_ADDR", "ZM_A01_NO_GLOBALLY_REACHABLE_ADDR", "ZM_A01_NO_NAME_SERVERS_FOUND" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Name server address must be globally reachable" }, "dns-address02" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address02.html).\n\n# Objective\n\nSome anti-spam techniques use reverse DNS lookup to allow incoming traffic.\nIn order to prevent name servers to be blocked or blacklisted, DNS \nadministrators should publish PTR records associated to name server\naddresses.\n\nTODO: Technical reference to be found\n\n", "Errors" : [ "ZM_NAMESERVER_IP_WITHOUT_REVERSE", "ZM_NO_RESPONSE_PTR_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Reverse DNS entry exists for name server IP address" }, "dns-address03" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Address-TP/address03.html).\n\n# Objective\n\nSome anti-spam techniques use reverse DNS lookup to allow incoming traffic.\nIn order to prevent name servers to be blocked or blacklisted, DNS \nadministrators should publish PTR records associated with the name server\naddresses. \n\nMoreover, as mentioned in paragraph 2.1 of [RFC\n1912](https://datatracker.ietf.org/doc/html/rfc1912) when a PTR record exists, it must match the host\nname.\n\n", "Errors" : [ "ZM_NAMESERVER_IP_WITHOUT_REVERSE", "ZM_NO_RESPONSE_PTR_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Reverse DNS entry matches name server name" }, "dns-connectivity01" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html).\n\n# Objective\n\nUDP is the fundamental protocol to reach a general purpose name server hosting\na zone, \"DNS servers MUST be able to service UDP \\[...]\" ([RFC 1123], section\n6.1.3.2, page 75), also restated in [RFC 7766][RFC 7766#5], section 5.\n\nThis Test Case will verify if the name servers of *Child Zone* are reachable over\nUDP. The name servers tested are both those in the delegation of *Child Zone* and\nthose in the NS records in the *Child Zone* itself.\n\nMost Zonemaster Test Cases will query the name servers in the delegation or the\nname servers appointed by the NS records in the zone for the NS or SOA record,\nor both. It is crucial that problems are reported, but instead of letting several\nTest Cases report the same problems found, most Test Cases assume that this test\ncase is run. Only this Test Case will report problems found in the following\nareas over UDP:\n\n* Name Server not responding to a query without EDNS.\n* Name Server not including SOA record of *Child Zone* in the answer section in\n the response on a SOA query for *Child Zone*.\n* Name Server not including NS record of *Child Zone* in the answer section in\n the response on an NS query for *Child Zone*.\n* Name Server not setting the AA flag in a response with SOA or NS in answer\n section.\n* Name Server responding with unexpected [RCODE Name] (any except \"NoError\") on\n query for SOA or NS for *Child Zone*.\n\nIn addition, this test case will output a message if transport over IPv4 or IPv6\nhas been disabled.\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[Basic02]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/basic02.md\n[CN01_IPV4_DISABLED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_IPV6_DISABLED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_MISSING_NS_RECORD_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_MISSING_SOA_RECORD_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_NO_RESPONSE_NS_QUERY_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_NO_RESPONSE_SOA_QUERY_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_NO_RESPONSE_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_NS_RECORD_NOT_AA_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_SOA_RECORD_NOT_AA_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_UNEXPECTED_RCODE_NS_QUERY_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_UNEXPECTED_RCODE_SOA_QUERY_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_WRONG_NS_RECORD_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CN01_WRONG_SOA_RECORD_UDP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.html#summary\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[DEBUG]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[DNS Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dns-query\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNS Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dns-response\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 1035#4.2.1]: https://www.rfc-editor.org/rfc/rfc1035#section-4.2.1\n[RFC 1123]: https://www.rfc-editor.org/rfc/rfc1123\n[RFC 7766#5]: https://www.rfc-editor.org/rfc/rfc7766#section-5\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_CN01_MISSING_NS_RECORD_UDP", "ZM_CN01_MISSING_SOA_RECORD_UDP", "ZM_CN01_NO_RESPONSE_NS_QUERY_UDP", "ZM_CN01_NO_RESPONSE_SOA_QUERY_UDP", "ZM_CN01_NO_RESPONSE_UDP", "ZM_CN01_NS_RECORD_NOT_AA_UDP", "ZM_CN01_SOA_RECORD_NOT_AA_UDP", "ZM_CN01_UNEXPECTED_RCODE_NS_QUERY_UDP", "ZM_CN01_UNEXPECTED_RCODE_SOA_QUERY_UDP", "ZM_CN01_WRONG_NS_RECORD_UDP", "ZM_CN01_WRONG_SOA_RECORD_UDP" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "UDP connectivity to name servers" }, "dns-connectivity02" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html).\n\n# Objective\n\nTCP is a protocol to reach a general purpose name server hosting a zone, \"All\ngeneral-purpose DNS implementations MUST support \\[...] TCP transport\"\n([RFC 7766][RFC 7766#5], section 5).\n\nThis Test Case will verify if the name servers of *Child Zone* are reachable over\nTCP. The name servers tested are both those in the delegation of *Child Zone* and\nthose in the NS records in the *Child Zone* itself.\n\nThis Test Case will mimic the tests done by [Connectivity01], but over TCP\ninstead:\n\n* Name Server responding to a query.\n* Name Server including SOA record of *Child Zone* in the answer section in the\n response on a SOA query for *Child Zone*.\n* Name Server including NS record of *Child Zone* in the answer section in the\n response on an NS query for *Child Zone*.\n* Name Server setting the AA flag in a response with SOA or NS in answer section.\n* Name Server responding with expected [RCODE Name] (\"NoError\") on query for SOA\n or NS for *Child Zone*.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CN02_MISSING_NS_RECORD_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_MISSING_SOA_RECORD_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_NO_RESPONSE_NS_QUERY_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_NO_RESPONSE_SOA_QUERY_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_NO_RESPONSE_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_NS_RECORD_NOT_AA_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_SOA_RECORD_NOT_AA_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_UNEXPECTED_RCODE_NS_QUERY_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_UNEXPECTED_RCODE_SOA_QUERY_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_WRONG_NS_RECORD_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CN02_WRONG_SOA_RECORD_TCP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity02.html#summary\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DEBUG]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[DNS Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dns-query\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNS Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dns-response\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 1035#4.2.1]: https://www.rfc-editor.org/rfc/rfc1035#section-4.2.1\n[RFC 7766#5]: https://www.rfc-editor.org/rfc/rfc7766#section-5\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_CN02_MISSING_NS_RECORD_TCP", "ZM_CN02_MISSING_SOA_RECORD_TCP", "ZM_CN02_NO_RESPONSE_NS_QUERY_TCP", "ZM_CN02_NO_RESPONSE_SOA_QUERY_TCP", "ZM_CN02_NO_RESPONSE_TCP", "ZM_CN02_NS_RECORD_NOT_AA_TCP", "ZM_CN02_SOA_RECORD_NOT_AA_TCP", "ZM_CN02_UNEXPECTED_RCODE_NS_QUERY_TCP", "ZM_CN02_UNEXPECTED_RCODE_SOA_QUERY_TCP", "ZM_CN02_WRONG_NS_RECORD_TCP", "ZM_CN02_WRONG_SOA_RECORD_TCP" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "TCP connectivity to name servers" }, "dns-connectivity03" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity03.html).\n\n# Objective\n\nThe objective in this test is to verify that all IP addresses of the domain's\nauthoritative name servers are announced from different ASNs (autonomous system \nnumber). See [RFC 1930] and [Wikipedia] for an explanation of AS (autonomous \nsystem).\n\nThis test is done separately on IPv4 and IPv6, and both must match the criterion.\n\n[RFC 2182][RFC 2182#3.1], section 3.1, clearly specifies that distinct authoritative \nname servers for a child domain should be placed in different topological and \ngeographical locations. The objective is to minimise the likelihood of a single \nfailure disabling all of them. \n\n\n\n[Bgp.tools]: https://bgp.tools/\n[Cymru database]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity03.html#cymru-asn-lookup\n[IP to ASN Mapping]: https://www.team-cymru.com/ip-asn-mapping\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[RFC 1035#3.5]: https://datatracker.ietf.org/doc/html/rfc1035#section-3.5\n[RFC 1930]: https://datatracker.ietf.org/doc/html/rfc1930\n[RFC 2182#3.1]: https://datatracker.ietf.org/doc/html/rfc2182#section-3.1\n[RFC 3596#2.5]: https://datatracker.ietf.org/doc/html/rfc3596#section-2.5\n[RIPE database]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity03.html#ripe-asn-lookup\n[RISwhois]: https://www.ripe.net/analyse/archived-projects/ris-tools-web-interfaces/riswhois\n[Wikipedia]: https://en.wikipedia.org/wiki/Autonomous_system_(Internet)\n", "Errors" : [ "ZM_IPV4_ONE_ASN", "ZM_IPV6_ONE_ASN" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "AS Diversity" }, "dns-consistency02" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html).\n\n# Objective\n\nAll authoritative name servers must serve the same SOA record for the\ntested domain (section 4.2.1 of [RFC 1034]). As per section 3.3.13 of [RFC 1035],\nthe RNAME field in the SOA RDATA refers to the administrative contact. An inconsistency in\nthe administrative contact for the domain might result in operational\nfailures being reported to different persons.\n\nThe objective of this test is to verify that the administrative contact is\nconsistent between different authoritative name servers.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MULTIPLE_SOA_RNAMES]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html#outcomes\n[NO_RESPONSE_SOA_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html#outcomes\n[ONE_SOA_RNAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.html#outcomes\n[RFC 1034]: https://datatracker.ietf.org/doc/html/rfc1034\n[RFC 1035]: https://datatracker.ietf.org/doc/html/rfc1035\n[RFC 1982]: https://datatracker.ietf.org/doc/html/rfc1982\n", "Errors" : [ "ZM_MULTIPLE_SOA_RNAMES", "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_SOA_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "SOA RNAME consistency" }, "dns-consistency03" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html).\n\n# Objective\n\nAll SOA record timer fields must be consistent across all authoritative \nname servers. An inconsistency in these fields might result in operational \ninconsistencies for the designated zone.\n\nThere are other test cases that provide consistency tests for the other\nSOA fields:\n\n* [CONSISTENCY01] (SOA Serial)\n* [CONSISTENCY02] (RNAME)\n* [CONSISTENCY06] (MNAME)\n\n\n[CONSISTENCY01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency01.md\n[CONSISTENCY02]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.md\n[CONSISTENCY06]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.md\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MULTIPLE_SOA_TIME_PARAMETER_SET]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html#outcomes\n[NO_RESPONSE_SOA_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html#outcomes\n[ONE_SOA_TIME_PARAMETER_SET]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.html#outcomes\n", "Errors" : [ "ZM_MULTIPLE_SOA_TIME_PARAMETER_SET", "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_SOA_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "SOA timers consistency" }, "dns-consistency04" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html).\n\n# Objective\n\nAll authoritative name servers must serve the same NS record set\nfor the tested domain, child zone ([RFC 1034], section 4.2.2).\nAny inconsistencies in NS records described in [RFC 1035], \nsection 3.3.11, might result in operational failures.\n\nThe objective of this test is to verify that the NS records are\nconsistent between all authoritative name servers of the child zone.\n\nTwo NS RR sets are considered to be equal if both sets have the \nsame number of NS records, and for each NS record in one of the \nsets there is exactly one NS record with identical owner name, \nclass, TTL and RDATA in the other NS set.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MULTIPLE_NS_SET]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#outcomes\n[NO_RESPONSE_NS_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#outcomes\n[ONE_NS_SET]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency04.html#outcomes\n[RFC 1034]: https://datatracker.ietf.org/doc/html/rfc1034\n[RFC 1035]: https://datatracker.ietf.org/doc/html/rfc1035\n", "Errors" : [ "ZM_MULTIPLE_NS_SET", "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_NS_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Name server NS consistency" }, "dns-consistency05" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html).\n\n# Objective\n\nFor name servers that have IP addresses listed as glue, the IP addresses must\nmatch the authoritative A and AAAA records for that host. This is an IANA \n[name server requirement].\n\nThe objective of this test is to verify that the [glue records][terminology] \nin the delegation are consistent with authoritative data.\n\n\n[ADDRESSES_MATCH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[BASIC01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Basic-TP/basic01.md\n[CHILD_NS_FAILED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[CHILD_ZONE_LAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DELEGATION05]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.md\n[EXTRA_ADDRESS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[IN_BAILIWICK_ADDR_MISMATCH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[Method2]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-2-obtain-glue-name-records-from-parent\n[Method3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-3-obtain-name-servers-from-child\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[Methods]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[OUT_OF_BAILIWICK_ADDR_MISMATCH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[RFC 7719]: https://datatracker.ietf.org/doc/html/rfc7719\n[UNDEL_OOB_ADDR_MISMATCH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#outcomes\n[name server requirement]: https://www.iana.org/help/nameserver-requirements\n[terminology]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency05.html#terminology\n[undelegated test]: https://doc.zonemaster.net/v2025.2.1/specifications/test-types/undelegated-test.md\n", "Errors" : [ "ZM_CHILD_NS_FAILED", "ZM_CHILD_ZONE_LAME", "ZM_EXTRA_ADDRESS_CHILD", "ZM_IN_BAILIWICK_ADDR_MISMATCH", "ZM_NO_RESPONSE", "ZM_OUT_OF_BAILIWICK_ADDR_MISMATCH" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Consistency between glue and authoritative data" }, "dns-consistency06" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html).\n\n# Objective\n\nAll authoritative name servers must serve the same SOA record (section\n4.2.1) of [RFC 1034] for the tested domain. As per section 3.3.13 of \n[RFC 1035] the MNAME field in the SOA RDATA refers to the name of \n\"the name server that was the original or primary source of data \nfor this zone\". Inconsistency in MNAME of the domain might result in \noperational failures for applications that uses MNAME.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MULTIPLE_SOA_MNAMES]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html#outcomes\n[NO_RESPONSE_SOA_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html#outcomes\n[ONE_SOA_MNAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.html#outcomes\n[RFC 1034]: https://datatracker.ietf.org/doc/html/rfc1035\n[RFC 1035]: https://datatracker.ietf.org/doc/html/rfc1035\n", "Errors" : [ "ZM_MULTIPLE_SOA_MNAMES", "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_SOA_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "SOA MNAME consistency" }, "dns-delegation01" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html).\n\n# Objective\n\nSection 4.1 of [RFC 1034] specifies that there must be a minimum of two name servers \nfor a domain. This test is done to verify this condition.\n\nThe RFC ([RFC 1034]) predates IPv6. Since IPv4 and IPv6 work as separate networks, this\ntest case has been extended to test for two name servers that resolve into IPv4 addresses\nand IPv6 addresses respectively.\n\nBoth [RFC 3901] (section 3) and [RFC 4472] (section 1.3) states that a domain \n(zone) should be available over IPv4 for the time being. Therefore, it is by the \ndefault level in this test case considered to be more problematic not being available \nover IPv4 than not being available over IPv6.\n\n\n[ENOUGH_IPV4_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[ENOUGH_IPV4_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[ENOUGH_IPV6_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[ENOUGH_IPV6_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[ENOUGH_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[ENOUGH_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[Method2]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-2-obtain-glue-name-records-from-parent\n[Method3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-3-obtain-name-servers-from-child\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOT_ENOUGH_IPV4_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NOT_ENOUGH_IPV4_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NOT_ENOUGH_IPV6_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NOT_ENOUGH_IPV6_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NOT_ENOUGH_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NOT_ENOUGH_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NO_IPV4_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NO_IPV4_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NO_IPV6_NS_CHILD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[NO_IPV6_NS_DEL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation01.html#outcomes\n[RFC 1034]: https://datatracker.ietf.org/doc/html/rfc1034\n[RFC 3901]: https://datatracker.ietf.org/doc/html/rfc3901\n[RFC 4472]: https://datatracker.ietf.org/doc/html/rfc4472\n", "Errors" : [ "ZM_NOT_ENOUGH_IPV4_NS_CHILD", "ZM_NOT_ENOUGH_IPV4_NS_DEL", "ZM_NOT_ENOUGH_IPV6_NS_CHILD", "ZM_NOT_ENOUGH_IPV6_NS_DEL", "ZM_NOT_ENOUGH_NS_CHILD", "ZM_NOT_ENOUGH_NS_DEL", "ZM_NO_IPV4_NS_CHILD", "ZM_NO_IPV4_NS_DEL", "ZM_NO_IPV6_NS_CHILD", "ZM_NO_IPV6_NS_DEL" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Minimum number of name servers " }, "dns-delegation02" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html).\n\n# Objective\n\nIf the domain's name servers use several different names, they can all\nbe using the same IP address. This may be due to a configuration error, or\na workaround for a certain policy restriction. This test case checks that\nthe name servers used do not reuse the same IP addresses.\n\nSection 4.1 of [RFC 1034] says at least two name servers must be used \nfor a delegation.\n\n\n[CHILD_DISTINCT_NS_IP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#outcomes\n[CHILD_NS_SAME_IP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#outcomes\n[DEL_DISTINCT_NS_IP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#outcomes\n[DEL_NS_SAME_IP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation02.html#outcomes\n[Method2]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-2-obtain-glue-name-records-from-parent\n[Method3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-3-obtain-name-servers-from-child\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[RFC 1034]: https://datatracker.ietf.org/doc/html/rfc1034\n", "Errors" : [ "ZM_CHILD_NS_SAME_IP", "ZM_DEL_NS_SAME_IP", "ZM_SAME_IP_ADDRESS" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Name servers must have distinct IP addresses" }, "dns-delegation03" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html).\n\n# Objective\n\nThe Domain Name System defaults to using UDP for queries and answers with a\nDNS payload limit of 512 octets (bytes). Larger replies cause an initial \ntruncation indication leading to a subsequent handling via TCP with \nsubstantially higher overhead. EDNS0 is used to allow for larger UDP \nresponses thus reducing the need for use of TCP.\n\nBut [IANA] still maintains that referrals from the parent zone name servers \nmust fit into a non-EDNS0 UDP DNS packet.\n\n\n[IANA]: https://www.iana.org/help/nameserver-requirements\n[In-Bailiwick of Parent]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html#in-bailiwick-of-parent\n[Method1]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-1-obtain-the-parent-domain\n[Method2]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-2-obtain-glue-name-records-from-parent\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[REFERRAL_SIZE_OK]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html#outcomes\n[REFERRAL_SIZE_TOO_LARGE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html#outcomes\n[RFC 1035]: https://datatracker.ietf.org/doc/html/rfc1035\n[RFC 7719]: https://datatracker.ietf.org/doc/html/rfc7719\n[in-bailiwick]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation03.html#terminology\n", "Errors" : [ "ZM_REFERRAL_SIZE_TOO_LARGE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "No truncation of referrals" }, "dns-delegation04" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation04.html).\n\n# Objective\n\nSubsection 6.1 of [RFC 2181](https://datatracker.ietf.org/doc/html/rfc2181) specifies\nthat the nameservers must answer authoritatively for the domain. Answers\nto queries to the name servers for the designated zone must have the \"AA\"\nbit set.\n\n", "Errors" : [ "ZM_IS_NOT_AUTHORITATIVE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Name server is authoritative" }, "dns-delegation05" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html).\n\n# Objective\n\nName servers for a zone are defined in NS records. An NS record points\nat a name, i.e. the RDATA for an NS record is a domain name. That\nname is the name of the name server. [RFC 2181][RFC 2181#10.3], section\n10.3, states that the name of the name server must not itself point at\na CNAME.\n\nThe objective of this test is to verify that name servers of the tested\ndomain (zone) do not point at CNAME records.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Lookup]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[Method2]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-2-obtain-glue-name-records-from-parent\n[Method3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-3-obtain-name-servers-from-child\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_NS_CNAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#outcomes\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#outcomes\n[NS_IS_CNAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#outcomes\n[RFC 2181#10.3]: https://datatracker.ietf.org/doc/html/rfc2181#section-10.3\n[RFC 8499#7]: https://datatracker.ietf.org/doc/html/rfc8499#section-7\n[UNEXPECTED_RCODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#outcomes\n[in-bailiwick]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[in-domain]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[out-of-bailiwick]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[sibling domain]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[terminology]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation05.html#terminology\n[undelegated test]: https://doc.zonemaster.net/v2025.2.1/specifications/test-types/undelegated-test.md\n", "Errors" : [ "ZM_NO_RESPONSE", "ZM_NS_IS_CNAME", "ZM_UNEXPECTED_RCODE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Name server must not point at CNAME alias" }, "dns-delegation07" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Delegation-TP/delegation07.html).\n\n# Objective\n\nIf the list of name servers for a domain obtained from its parent are not\nfound in its child zone, then it leads to an inconsistency (section 2.3\nof [RIPE-114](https://www.ripe.net/publications/docs/ripe-114))\n\n", "Errors" : [ "ZM_EXTRA_NAME_PARENT", "ZM_TOTAL_NAME_MISMATCH" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Parent glue name records present in child" }, "dns-nameserver01" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html).\n\n# Objective\n\nTo ensure consistency in DNS, an authoritative name server should not be\nconfigured to do recursive lookups. Also, open recursive resolvers are\nconsidered bad internet practice due to their capability of assisting in\nlarge scale DDoS attacks. The introduction to [RFC 5358] elaborates on \nmixing recursor and authoritative functionality, and the issue is further \nelaborated by [D.J. Bernstein].\n\nSection 2.5 of [RFC 2870] have very specific requirement on disabling \nrecursion functionality on root name servers.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[D.J. Bernstein]: https://cr.yp.to/djbdns/separation.html\n[IDNA 2008 specification]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html#terminology\n[IS_A_RECURSOR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RECURSOR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html#outcomes\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver01.html#outcomes\n[RFC 2870]: https://datatracker.ietf.org/doc/html/rfc2870\n[RFC 5358]: https://datatracker.ietf.org/doc/html/rfc5358\n[RFC 5890]: https://datatracker.ietf.org/doc/html/rfc5890\n", "Errors" : [ "ZM_IS_A_RECURSOR", "ZM_NO_RESPONSE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "A name server should not be a recursor" }, "dns-nameserver02" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html).\n\n# Objective\n\nEDNS(0) is a mechanism to announce capabilities of a DNS implementation,\nand is now basically required by any new functionality in DNS such as\nDNSSEC. EDNS(0) is standardized in [RFC 6891].\n\nThis test case checks that all name servers has the capability to do\nEDNS(0) or if not, correctly replies to queries containing EDNS\n(OPT record).\n\nServers not supporting EDNS(0) must return FORMERR \n([RFC 6891, section 7]):\n\n> Responders that choose not to implement the protocol extensions\n> defined in this document MUST respond with a return code (RCODE) of\n> FORMERR to messages containing an OPT record in the additional\n> section and MUST NOT include an OPT record in the response.\n\nServers supporting EDNS(0) must reply with EDNS(0)\n([RFC 6891, section 6.1.1]):\n\n> If an OPT record is present in a received request, compliant\n> responders MUST include an OPT record in their respective responses.\n\nTo eliminating the risk of falsely classifying the server as not supporting\nEDNS due e.g. firewall issues, the UDP buffer size is set to 512 bytes \n(octets).\n\n\n[BREAKS_ON_EDNS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[EDNS_RESPONSE_WITHOUT_EDNS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[EDNS_VERSION_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_EDNS_SUPPORT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[NS_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.html#outcomes\n[RFC 6891]: https://datatracker.ietf.org/doc/html/rfc6891\n[RFC 6891, section 6.1.1]: https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.1\n[RFC 6891, section 7]: https://datatracker.ietf.org/doc/html/rfc6891#section-7\n", "Errors" : [ "ZM_BREAKS_ON_EDNS", "ZM_EDNS_RESPONSE_WITHOUT_EDNS", "ZM_EDNS_VERSION_ERROR", "ZM_NO_EDNS_SUPPORT", "ZM_NO_RESPONSE", "ZM_NS_ERROR" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Test of EDNS0 support" }, "dns-nameserver04" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver04.html).\n\n# Objective\n\nResponses from the authoritative name servers must contain same source IP\naddress as the destination IP address of the initial query. This has been\nclarified in section 4 of\n[RFC 2181](https://datatracker.ietf.org/doc/html/rfc2181#section-4).\n\n", "Errors" : [ "ZM_DIFFERENT_SOURCE_IP" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Same source address" }, "dns-nameserver05" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html).\n\n# Objective\n\nOlder implementations of authoritative name servers have shown different\nmisbehaviours trying to answer queries for AAAA records, as described in\n[RFC 4074]. This test case is intended to find out if the name server\nauthoritative for the domain shows any of these behaviours.\n\n\n\n[AAAA_BAD_RDATA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[AAAA_QUERY_DROPPED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[AAAA_UNEXPECTED_RCODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[AAAA_WELL_PROCESSED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[A_UNEXPECTED_RCODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver05.html#outcomes\n[RFC 4074]: https://datatracker.ietf.org/doc/html/rfc4074\n", "Errors" : [ "ZM_AAAA_BAD_RDATA", "ZM_AAAA_QUERY_DROPPED", "ZM_AAAA_UNEXPECTED_RCODE", "ZM_A_UNEXPECTED_RCODE", "ZM_NO_RESPONSE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Behaviour against AAAA query" }, "dns-nameserver06" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver06.html).\n\n# Objective\n\nAll name servers names listed for a delegation must be resolvable in DNS.\nIf they are not resolvable using DNS this is a sign of misconfiguration,\nand raises the risk of unreachability for the domain. It could also lower\nthe performance for any resolver trying to resolve the name.\n\nThe objective of this test is to resolve the domain using all the listed\nname servers used in the delegation. More information about resolver\nbehavior is in section 7 of [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035).\n\n", "Errors" : [ "ZM_CAN_NOT_BE_RESOLVED", "ZM_NO_RESOLUTION" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "NS can be resolved" }, "dns-nameserver08" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver08.html).\n\n# Objective\nThe DNS standards require that nameservers treat names with case insensitivity.\nThat is, the names example.com and EXAMPLE.COM should resolve to the same IP\naddress. However, in the response, most nameservers echo back the name as it\nappeared in the request, preserving the original case.\n\nTherefore, another way to add entropy to requests is to randomly vary the case\nof letters in domain names queried. This technique, also known as \"0x20\" because\nbit 0x20 is used to set the case of of US-ASCII letters, was first proposed in\nthe [IETF internet draft](https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00) Use of Bit 0x20 in DNS Labels to Improve Transaction\nIdentity. With this technique, the nameserver response must match not only the\nquery name, but the case of every letter in the name string; for example,\nwWw.eXaMpLe.CoM or WwW.ExamPLe.COm. This may add little or no entropy to queries\nfor the top-level and root domains, but it's effective for most hostnames.\n\n", "Errors" : [ "ZM_QNAME_CASE_INSENSITIVE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Testing QNAME case insensitivity " }, "dns-nameserver09" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver09.html).\n\n# Objective\nThere has been cases where the nameservers respond with complete\ncase-sensitivity (in violation of the DNS standards): that is, they match the\nexact case of the name in the response; but return different results for\nequivalent names with different cases in the request (typically NXDOMAIN). \n\n\n", "Errors" : [ "ZM_CASE_QUERIES_RESULTS_DIFFER", "ZM_CASE_QUERY_DIFFERENT_ANSWER", "ZM_CASE_QUERY_DIFFERENT_RC", "ZM_CASE_QUERY_NO_ANSWER" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Testing QNAME case sensitivity" }, "dns-nameserver10" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html).\n\n# Objective\n\nEDNS ([RFC 6891]) is a mechanism to announce capabilities of a DNS\nimplementation, and is required by new functionality in DNS such as DNSSEC\n([RFC 4033][RFC 4033#section-3], section 3).\n\n[RFC 6891][RFC 6891#section-6.1.3], section 6.1.3, states that if a nameserver\nhas implemented EDNS but has not implemented the version level of the request,\nthen it MUST respond with RCODE \"BADVERS\". Only version \"0\" has been defined for\nEDNS.\n\nNote that RCODE \"BADVERS\" is an extended RCODE which is calculated from the\ncombination of the normal RCODE field in the DNS package header\n([RFC 1035][RFC 1035#section-4.1.1], section 4.1.1) and the OPT record\nEXTENDED-RCODE field ([RFC 6891][RFC 6891#section-6.1.3], section 6.1.3). Also\nsee [IANA RCODE Registry].\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA RCODE Registry]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[N10_EDNS_RESPONSE_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#summary\n[N10_NO_RESPONSE_EDNS1_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#summary\n[N10_UNEXPECTED_RCODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver10.html#summary\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[Nameserver02]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.md\n[RFC 1035#section-4.1.1]: https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.1\n[RFC 4033#section-3]: https://datatracker.ietf.org/doc/html/rfc4033#section-3\n[RFC 6891]: https://datatracker.ietf.org/doc/html/rfc6891\n[RFC 6891#section-6.1.3]: https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.3\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_N10_EDNS_RESPONSE_ERROR", "ZM_N10_NO_RESPONSE_EDNS1_QUERY", "ZM_N10_UNEXPECTED_RCODE" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Test for undefined EDNS version" }, "dns-nameserver11" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html).\n\n# Objective\n\nEDNS is a mechanism to announce capabilities of a DNS implementation,\nand is now basically required by any new functionality in DNS such as\nDNSSEC ([RFC 6891]).\n\n[RFC 6891][RFC 6891, section 6.1.2], section 6.1.2, states that any OPTION-CODE values\nnot understood by a responder or requestor MUST be ignored. Unknown OPTION-CODE values\nmust be processed as though the OPTION-CODE was not even there.\n\nIn this test case, we will query with an unknown EDNS OPTION-CODE and expect\nthat the OPTION-CODE is not present in the response for the query.\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[EDNS Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-edns-query\n[EDNS Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-an-edns-response\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA-DNSSYSTEM-PARAMETERS]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-11\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Message Tag Specification]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/MessageTagSpecification.md\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[Methods]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md\n[N11_NO_EDNS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[N11_NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[N11_RETURNS_UNKNOWN_OPTION_CODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[N11_UNEXPECTED_ANSWER_SECTION]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[N11_UNEXPECTED_RCODE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[N11_UNSET_AA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver11.html#summary\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[Nameserver02]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver02.md\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 6891]: https://datatracker.ietf.org/doc/html/rfc6891\n[RFC 6891, section 6.1.2]: https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Test Case Identifier Specification]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/TestCaseIdentifierSpecification.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_N11_NO_EDNS", "ZM_N11_NO_RESPONSE", "ZM_N11_RETURNS_UNKNOWN_OPTION_CODE", "ZM_N11_UNEXPECTED_ANSWER_SECTION", "ZM_N11_UNEXPECTED_RCODE", "ZM_N11_UNSET_AA" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Test for unknown EDNS OPTION-CODE" }, "dns-nameserver12" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html).\n\n# Objective\n\nEDNS is a mechanism to announce capabilities of a dns implementation,\nand is now basically required by any new functionality in dns such as\nDNSSEC ([RFC 6891]).\n\n[RFC 6891][RCF 6891#section-6.1.4], section 6.1.4, states that \"Z\"\nflag bits must be set to zero by senders and ignored by receiver.\n\n[IANA] lists the flags in the [EDNS Header Flags] assignment list.\n\nIn this test case, the query will have an unknown EDNS flag set, i.e.\none of the Z flag bits set to \"1\", and it is expected that all \"Z\" \nbits to be clear in the response (set to \"0\").\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[EDNS Header Flags]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-13\n[IANA]: https://www.iana.org/\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_EDNS_SUPPORT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html#outcomes\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html#outcomes\n[NS_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html#outcomes\n[RCF 6891#section-6.1.4]: https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.4\n[RFC 6891]: https://datatracker.ietf.org/doc/html/rfc6891\n[Z_FLAGS_NOTCLEAR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver12.html#outcomes\n", "Errors" : [ "ZM_NO_EDNS_SUPPORT", "ZM_NO_RESPONSE", "ZM_NS_ERROR", "ZM_Z_FLAGS_NOTCLEAR" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Test for unknown EDNS flags" }, "dns-nameserver13" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html).\n\n# Objective\n\nEDNS is a mechanism to announce capabilities of a DNS implementation,\nand is now basically required by any new functionality in DNS such as\nDNSSEC ([RFC 6891]).\n\n[RFC 6891, section 7] states that an OPT record must be included\nin a truncated response, if the query includes an OPT pseudo record.\n\nThis Test Case will try to verify that if the response to a query with an OPT\nrecord is truncated, then the response will contain an OPT record.\n\nTo trigger a truncated response, the OPT pseudo record 'DO' bit is set and the\nbuffer size is limited to 512 bytes. If the zone is not signed with DNSSEC, the\nresponse will probably not be truncated anyway.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MISSING_OPT_IN_TRUNCATED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NO_EDNS_SUPPORT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#outcomes\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#outcomes\n[NS_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Nameserver-TP/nameserver13.html#outcomes\n[RFC 6891]: https://datatracker.ietf.org/doc/html/rfc6891\n[RFC 6891, section 7]: https://datatracker.ietf.org/doc/html/rfc6891#section-7\n", "Errors" : [ "ZM_MISSING_OPT_IN_TRUNCATED", "ZM_NO_EDNS_SUPPORT", "ZM_NO_RESPONSE", "ZM_NS_ERROR" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Test for truncated response on EDNS query" }, "dns-syntax05" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax05.html).\n\n# Objective\n\nThe SOA RNAME field does not allow the '@' characters to be used for\ndescribing a mailbox. The first dot ('.') is thus translated into the\n'@' character. This is a common mistake. The rules are defined in\n[RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035).\n\n\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n", "Errors" : [ "ZM_NO_RESPONSE_SOA_QUERY", "ZM_RNAME_MISUSED_AT_SIGN" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Misuse of '@' character in the SOA RNAME field" }, "dns-syntax06" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html).\n\n# Objective\n\nThe SOA RNAME field is a mailbox address. The SOA RNAME field is defined\nin [RFC 1035][RFC 1035#3.3.13], section 3.3.13 and in\n[RFC 1912][RFC 1912#2.2], section 2.2. The RNAME\nfield should follow the rules of an e-mail address also defined in\n[RFC 5322][RFC 5322#3.4.1], section 3.4.1.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[Methods]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[NO_RESPONSE_SOA_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[RFC 1035]: https://datatracker.ietf.org/doc/html/rfc1035\n[RFC 1035#3.3.13]: https://datatracker.ietf.org/doc/html/rfc1035#section-3.3.13\n[RFC 1035#5.1]: https://datatracker.ietf.org/doc/html/rfc1035#section-5.1\n[RFC 1035#5.3]: https://datatracker.ietf.org/doc/html/rfc1035#section-5.3\n[RFC 1035#8]: https://datatracker.ietf.org/doc/html/rfc1035#section-8\n[RFC 1912#2.2]: https://datatracker.ietf.org/doc/html/rfc1912#section-2.2\n[RFC 5322#3.4.1]: https://datatracker.ietf.org/doc/html/rfc5322#section-3.4.1\n[RNAME_MAIL_DOMAIN_INVALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[RNAME_MAIL_DOMAIN_LOCALHOST]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[RNAME_MAIL_ILLEGAL_CNAME]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[RNAME_RFC822_INVALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[RNAME_RFC822_VALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#outcomes\n[terminology]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax06.html#terminology\n[undelegated test]: https://doc.zonemaster.net/v2025.2.1/specifications/test-types/undelegated-test.md\n", "Errors" : [ "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_SOA_QUERY", "ZM_RNAME_MAIL_DOMAIN_INVALID", "ZM_RNAME_MAIL_DOMAIN_LOCALHOST", "ZM_RNAME_MAIL_ILLEGAL_CNAME", "ZM_RNAME_RFC822_INVALID" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "No illegal characters in the SOA RNAME field" }, "dns-syntax07" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Syntax-TP/syntax07.html).\n\n# Objective\n\nThe SOA MNAME field is a hostname. Hostnames are valid according to the\nrules defined in [RFC 952](https://datatracker.ietf.org/doc/html/rfc952),\nin section 2.1 in [RFC 1123](https://datatracker.ietf.org/doc/html/rfc1123#section-2.1),\nsection 11 in [RFC 2182](https://datatracker.ietf.org/doc/html/rfc2181#section-11) and\nsection 2 and 5 in [RFC 3696](https://datatracker.ietf.org/doc/html/rfc3696#section-2).\nNewer RFCs may override some rules defined in earlier documents.\n\n", "Errors" : [ "ZM_MNAME_DISCOURAGED_DOUBLE_DASH", "ZM_MNAME_NON_ALLOWED_CHARS", "ZM_MNAME_NUMERIC_TLD", "ZM_NO_RESPONSE_SOA_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "No illegal characters in the SOA MNAME field" }, "dns-zone07" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone07.html).\n\n# Objective\n\nAny NS type record should not be a CNAME. The SOA MNAME should in this\nrespect not be a CNAME.\n\nQuote from 2.4 in [RFC 1912](https://datatracker.ietf.org/doc/html/rfc1912):\n\n> Having NS records pointing to a CNAME is bad and may conflict badly\n> with current BIND servers.\n\nThe SOA MNAME field is described in section 3.3.13 in\n[RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035).\n\nThe [RIPE-203](https://www.ripe.net/publications/docs/ripe-203) recommendation\nfor the minimum value 2 days, but the negative caching is now the norm.\nDNSCheck has a recommended value of between 300 seconds (5 minutes) and\n86400 seconds (1 day).\n\n", "Errors" : [ "ZM_MNAME_HAS_NO_ADDRESS", "ZM_NO_RESPONSE_SOA_QUERY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "SOA master is not an alias" }, "dns-zone10" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html).\n\n# Objective\n\nThe SOA record is crucial for the DNS zone and \"exactly one SOA RR should\nbe present at the top of the zone\" ([RFC 1035][RFC 1035#5.2], section 5.2).\nThis test case will verify that the zone of the domain to be tested return\nexactly one SOA record.\n\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[MULTIPLE_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[Methods]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#outcomes\n[NO_SOA_IN_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#outcomes\n[ONE_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#outcomes\n[RFC 1035#5.2]: https://datatracker.ietf.org/doc/html/rfc1035#section-5.2\n[WRONG_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#outcomes\n[terminology]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Zone-TP/zone10.html#terminology\n", "Errors" : [ "ZM_MULTIPLE_SOA", "ZM_NO_RESPONSE", "ZM_NO_SOA_IN_RESPONSE", "ZM_WRONG_SOA" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "No multiple SOA records" }, "dns-zz-consistency" : { "Description" : "In addition to the other tests case in this suite, which come from\nZonemaster, this test case verifies that all the nameservers (both logical\nand physical) specified in the `dns.nameservers` input parameter provide\nconsistent responses.\n\nThe test system will perform DNS queries from probe nodes in multiple\nlocations around the world so that multiple physical nodes within an\nanycasted logical nameserver are tested.\n\nFor each TLD in the test, the following queries will be sent, over UDP, TCP,\nand any additional transports that are supported (based on the\n`supportsDoT`, `supportsDoH` and `supportsDoQ` properties for the nameserver\nin question) to each IPv4 and IPv6 address for each nameserver:\n\n* apex `SOA` query;\n* apex `NS` query;\n* apex `DNSKEY` query;\n* apex `NSEC3PARAM` query;\n* apex `TXT` query;\n* `A` and `AAAA` queries for in-bailiwick nameservers, if any;\n* `nic.tld` `NS` and `DS` query (these records **MUST** be present in the\n TLD zone).\n\nThe EDNS(0) `do` bit, `NSID` option, and `ZONEVERSION` options will be set\non all queries. The reported `NSID` and `ZONEVERSION` values in the response\n(if any) will be included in logs for debugging purposes.\n\nFor DoT, DoH and DoQ, no certificate validation will be performed.\n\nThe test case will fail if:\n\n1. one or more queries timeout (within 1000ms for UDP and 3000ms for\n any other protocol), or\n2. The RCODE header field, or answer, authority or additional sections of\n the response differs, after normalization, from those of any previously\n received response, with the sole exception of the `serial` field of `SOA`\n records.\n", "Errors" : [ "DNS_CONSISTENCY_QUERY_FAILED", "DNS_INCONSISTENT_RESPONSES" ], "Implemented" : "", "Maturity" : "BETA", "Summary" : "Nameserver consistency check" }, "dns-zz-idna2008-compliance" : { "Description" : "In addition to the other tests case in this suite, which come from\nZonemaster, this test case exists to confirm that all DNS host names which\nappear in resource records at the TLD apex conform to the IDNA2008\nspecifications, described in [RFC\n5890](https://www.rfc-editor.org/rfc/rfc5890.html).\n\nThe names that appear in the `MNAME` and `RNAME` fields of TLD `SOA`\nrecords, and in the apex `NS` records, **MUST** be comprised solely of (a)\nNR-LDH labels (see Section [2.3.2.2 of RFC\n5890](https://www.rfc-editor.org/rfc/rfc5890.html#section-2.3.2.2)) or (b)\nIDN labels that conform to the requirements of IDNA2008.\n", "Errors" : [ "DNS_IDNA2008_QUERY_FAILED", "DNS_IDNA2008_INVALID_MNAME", "DNS_IDNA2008_INVALID_RNAME", "DNS_IDNA2008_INVALID_NS_NSDNAME" ], "Implemented" : "", "Maturity" : "GAMMA", "Summary" : "IDNA2008 compliance check" }, "dnssec-01" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html).\n\n# Objective\n\nA parent zone should only use digest algorithms for DS records that are\nspecified by specified by [RFC 8624][RFC 8624#3.3], section 3.3 (including the\nupdate in [RFC 9157][RFC 9157#upd-8624]), and is published in the [IANA\nregistry][IANA registry on DS Digest Algorithm] of *DS RR Type Digest\nAlgorithms*. No DS Digest Algorithm values, other than those specified in the\nRFC and allocated by IANA, should be used in public DNS.\n\nA DS record for a public domain name (zone) should not use private digestet\nalgorithms.\n\nBoth [RFC 8624][RFC 8624#3.3] and [IANA registry][IANA registry on DS Digest\nAlgorithm] recommends digest algorithm 2 (SHA-256) to be used, and if there is a\nDS record for a DNSKEY, but no DS record based on that digest algorithm, a\nmessage is outputted as a NOTICE.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Classification of algorithms]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#classification-of-algorithms\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNSSEC Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dnssec-query\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dnssec-response\n[DS01_DS_ALGO_2_MISSING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_DEPRECATED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_NOT_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_OK]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_PRIVATE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_RESERVED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_DS_ALGO_UNASSIGNED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_PARENT_SERVER_NO_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_PARENT_ZONE_NO_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_ROOT_N_NO_UNDEL_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[DS01_UNDEL_N_NO_UNDEL_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[Get-Parent-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-parent-ns-names-and-ip-addresses\n[IANA RCODE List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[IANA registry on DS Digest Algorithm]: https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RFC 8624#3.3]: https://datatracker.ietf.org/doc/html/rfc8624#section-3.3\n[RFC 9157#upd-8624]: https://www.rfc-editor.org/rfc/rfc9157#name-update-to-rfc-8624\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Summary]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec01.html#summary\n[Undelegated]: https://doc.zonemaster.net/v2025.2.1/specifications/test-types/undelegated-test.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS01_DS_ALGO_2_MISSING", "ZM_DS01_DS_ALGO_DEPRECATED", "ZM_DS01_DS_ALGO_NOT_DS", "ZM_DS01_DS_ALGO_PRIVATE", "ZM_DS01_DS_ALGO_RESERVED", "ZM_DS01_DS_ALGO_UNASSIGNED", "ZM_DS01_NO_RESPONSE", "ZM_DS01_PARENT_SERVER_NO_DS" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Legal values for the DS hash digest algorithm" }, "dnssec-02" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\n_**Note:** References to \"Key Signing Keys\" in the description below also\nrefer to Combined Signing Keys, if used._\n\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html).\n\n# Objective\n\nDNS delegations from a parent to a child are secured with DNSSEC by\npublishing one or several Delegation Signer (DS) records in the parent\nzone, along with the NS records for the delegation.\n\nFor the secure delegation to work, at least one DS record must match a\nDNSKEY record in the child zone ([RFC 4035][RFC 4035#section-5], section 5).\nEach DS record should match a DNSKEY record in the child zone. More\nthan one DS may match the same DNSKEY. The DNSKEY that the DS record\nrefer to must be used to sign the DNSKEY RRset in the child zone\n([RFC 4035][RFC 4035#section-5], section 5).\n\nThe DNSKEY record that the DS record refer to must have bit 7\n(\"Zone Key flag\") set in the DNSKEY RR Flags ([RFC 4034][RFC 4034#section-5.2],\nsection 5.2).\n\nBit 15 (\"Secure Entry Point flag\") on a DNSKEY record signals that it\nis meant to be a KSK and pointed out by a DS record. It is noted if\nthe DNSKEY record that the DS points at does not have that flag set\n([RFC 4034][RFC 4034#section-2.1.1], section 2.1.1).\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNSSEC Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dnssec-query\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dnssec-response\n[DNSSEC11]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec11.md\n[DS02_ALGO_NOT_SUPPORTED_BY_ZM]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_DNSKEY_NOT_FOR_ZONE_SIGNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_DNSKEY_NOT_SEP]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_DNSKEY_NOT_SIGNED_BY_ANY_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_NO_DNSKEY_FOR_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_NO_MATCHING_DNSKEY_RRSIG]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_NO_MATCH_DS_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_NO_VALID_DNSKEY_FOR_ANY_DS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[DS02_RRSIG_NOT_VALID_BY_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec02.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA RCODE List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method1]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-1-obtain-the-parent-domain\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RFC 4034#section-2.1.1]: https://datatracker.ietf.org/doc/html/rfc4034#section-2.1.1\n[RFC 4034#section-5.2]: https://datatracker.ietf.org/doc/html/rfc4034#section-5.2\n[RFC 4035#section-5]: https://datatracker.ietf.org/doc/html/rfc4035#section-5\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Undelegated]: https://doc.zonemaster.net/v2025.2.1/specifications/test-types/undelegated-test.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS02_DNSKEY_NOT_FOR_ZONE_SIGNING", "ZM_DS02_DNSKEY_NOT_SEP", "ZM_DS02_DNSKEY_NOT_SIGNED_BY_ANY_DS", "ZM_DS02_NO_DNSKEY_FOR_DS", "ZM_DS02_NO_MATCHING_DNSKEY_RRSIG", "ZM_DS02_NO_MATCH_DS_DNSKEY", "ZM_DS02_NO_VALID_DNSKEY_FOR_ANY_DS", "ZM_DS02_RRSIG_NOT_VALID_BY_DNSKEY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "DS must match a valid DNSKEY in the child zone" }, "dnssec-03" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\n_**Note:** while failure conditions defined in this test case are weaker\nthan those defined in [dnssec-93](#Test-Case-dnssec-93), as of\n`Zonemaster::Engine` v5.0.0, this test case emits the\n[`ZM_DS03_NO_DNSSEC_SUPPORT`](#Error-ZM_DS03_NO_DNSSEC_SUPPORT) error, which\nis required to ensure that the TLD zone is properly signed with DNSSEC._\n\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html).\n\n# Objective\n\nThe NSEC3 record type and its parameters are defined in [RFC 5155]. The\nrecommended values of the parameters have been updated by [RFC 9276].\n\nFor NSEC3 there are four fields that determine how the NSEC3 record are created\nand interpreted ([RFC 5155][RFC 5155#section-3], section 3):\n\n* Hash algorithm\n* Flags\n* Iterations\n* Salt\n\n**Hash algorithm:** The only legal value of the hash algorithm is value 1\n(SHA-1). See ([RFC 5155][RFC 5155#section-11], section 11 and\n[IANA NSEC3 Parameters registry]).\n\n**Flags:** The only defined flags in the flag field is bit 7 (the least\nsignificant bit), \"opt-out\". It may only be set in the NSEC record, not in the\nNSEC3PARAM record ([RFC 5155][RFC 5155#section-11], section 11 and\n[IANA NSEC3 Parameters registry]). \"For small zones, the use of opt-out-based\nNSEC3 records is NOT RECOMMENDED. For very large and sparsely signed zones, where\nthe majority of the records are insecure delegations, opt-out MAY be used\"\n([RFC 9276][RFC 9276#section-3.1], section 3.1). This means that unless the zone\nis a TLD or a TLD like domain found in the [Public Suffix List] it should\nnot have the opt-out bit set.\n\n**Iterations:** For a name server an increased number of NSEC3 iterations have a\nnegative impact on performance. The recommendation is to have 0 iterations. \"If\nNSEC3 must be used, then an iterations count of 0 MUST be used to alleviate\ncomputational burdens\" ([RFC 9276][RFC 9276#section-3.1], section 3.1).\n\n**Salt:** The salt parameter has been seen as a security feature but\n[RFC 9276][RFC 9276#section-3.1], section 3.1, states that zones \"SHOULD NOT use\na salt by indicating a zero-length salt value instead\". The justification for\nthe recommendation is found in [RFC 9276][RFC 9276#section-2.4], section 2.4.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNSSEC Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dnssec-query\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dnssec-response\n[DS03_ERROR_RESPONSE_NSEC_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_ERR_MULT_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_ILLEGAL_HASH_ALGO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_ILLEGAL_ITERATION_VALUE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_ILLEGAL_SALT_LENGTH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_INCONSISTENT_HASH_ALGO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_INCONSISTENT_ITERATION]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_INCONSISTENT_NSEC3_FLAGS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_INCONSISTENT_SALT_LENGTH]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_LEGAL_EMPTY_SALT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_LEGAL_HASH_ALGO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_LEGAL_ITERATION_VALUE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NO_DNSSEC_SUPPORT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NO_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NO_RESPONSE_NSEC_QUERY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NSEC3_OPT_OUT_DISABLED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NSEC3_OPT_OUT_ENABLED_NON_TLD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_NSEC3_OPT_OUT_ENABLED_TLD]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_SERVER_NO_DNSSEC_SUPPORT]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_SERVER_NO_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[DS03_UNASSIGNED_FLAG_USED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA NSEC3 Parameters registry]: https://www.iana.org/assignments/dnssec-nsec3-parameters/dnssec-nsec3-parameters.xhtml\n[IANA RR Type List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[Public Suffix List]: https://publicsuffix.org/list/\n[Public Suffix List data]: https://publicsuffix.org/list/public_suffix_list.dat\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 5155]: https://www.rfc-editor.org/rfc/rfc5155.html\n[RFC 5155#section-11]: https://www.rfc-editor.org/rfc/rfc5155.html#section-11\n[RFC 5155#section-3]: https://www.rfc-editor.org/rfc/rfc5155.html#section-3\n[RFC 9276]: https://www.rfc-editor.org/rfc/rfc9276.html\n[RFC 9276#section-2.4]: https://www.rfc-editor.org/rfc/rfc9276.html#section-2.4\n[RFC 9276#section-3.1]: https://www.rfc-editor.org/rfc/rfc9276.html#section-3.1\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Test procedure]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec03.html#test-procedure\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS03_ERR_MULT_NSEC3", "ZM_DS03_ILLEGAL_HASH_ALGO", "ZM_DS03_ILLEGAL_ITERATION_VALUE", "ZM_DS03_ILLEGAL_SALT_LENGTH", "ZM_DS03_INCONSISTENT_HASH_ALGO", "ZM_DS03_INCONSISTENT_ITERATION", "ZM_DS03_INCONSISTENT_NSEC3_FLAGS", "ZM_DS03_INCONSISTENT_SALT_LENGTH", "ZM_DS03_NO_DNSSEC_SUPPORT", "ZM_DS03_SERVER_NO_DNSSEC_SUPPORT", "ZM_DS03_SERVER_NO_NSEC3", "ZM_DS03_UNASSIGNED_FLAG_USED" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Verify NSEC3 parameters" }, "dnssec-04" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec04.html).\n\n# Objective\n\nHaving RRSIG signature lifetimes last for too long opens up for DNS replay\nattacks. Having too short RRSIG signature lifetimes is likely to have\na major operational impact if the master name server is down for that long.\n\nThere is no clear recommendation of the exact validity periods to use with\nDNSSEC. Shorter validity than 12 hours until expiration will give a serious\noperational problem just in case of temporary network problems, and longer\nthan 180 days will create wide open holes for replay attacks.\n\nThe considerations are described in [RFC6781](\nhttps://datatracker.ietf.org/doc/html/rfc6781).\n\n\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n", "Errors" : [ "ZM_DURATION_LONG", "ZM_REMAINING_LONG", "ZM_REMAINING_SHORT", "ZM_RRSIG_EXPIRED" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Check for too short or too long RRSIG lifetimes" }, "dnssec-05" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html).\n\n# Objective\n\nA domain name (zone) should only use DNSKEY algorithms that are specified by\n[RFC 8624][RFC 8624#3.1], section 3.1 (including the update in\n[RFC 9157][RFC 9157#upd-8624]) and the [IANA registry][IANA DNSSEC algo num] of\n*DNSSEC Algorithm Numbers* to be used for DNSSEC signing. A public domain name\n(zone) should not use private algorithms.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Classification of algorithms]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#classification-of-algorithms\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNSSEC Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dnssec-query\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dnssec-response\n[DS05_ALGO_DEPRECATED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_NOT_RECOMMENDED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_NOT_ZONE_SIGN]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_OK]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_PRIVATE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_RESERVED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ALGO_UNASSIGNED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_SERVER_NO_DNSSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[DS05_ZONE_NO_DNSSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#outcomes\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[Get-Del-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-delegation-ns-names-and-ip-addresses\n[Get-Zone-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-zone-ns-names-and-ip-addresses\n[IANA DNSSEC algo num]: https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml\n[IANA RR Type List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 8624#3.1]: https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1\n[RFC 9157#upd-8624]: https://www.rfc-editor.org/rfc/rfc9157#name-update-to-rfc-8624\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Summary]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#Summary\n[Test procedure]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.html#Test-procedure\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS05_ALGO_DEPRECATED", "ZM_DS05_ALGO_NOT_RECOMMENDED", "ZM_DS05_ALGO_NOT_ZONE_SIGN", "ZM_DS05_ALGO_PRIVATE", "ZM_DS05_ALGO_RESERVED", "ZM_DS05_ALGO_UNASSIGNED", "ZM_DS05_NO_RESPONSE", "ZM_DS05_SERVER_NO_DNSSEC" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Check for invalid DNSKEY algorithms" }, "dnssec-06" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec06.html).\n\n# Objective\n\nIn order for an authoritative name server to be DNSSEC compliant,\nit must serve DNSSEC signatures (RRSIG) as additional data in a DNS answer.\nThis additional processing is described in section 3.1 of [RFC 4035](\nhttps://datatracker.ietf.org/doc/html/rfc4035#section-3.1).\n\n", "Errors" : [ "ZM_EXTRA_PROCESSING_BROKEN" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Verify DNSSEC additional processing" }, "dnssec-08" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html).\n\n# Objective\n\nA DNSSEC signed zone should have a DNSKEY RRset in the zone apex\n([RFC 4035][RFC 4035#section-2.1], section 2.1) and that RRset\nshould be signed by a key that matches one of the records in the\nDNSKEY RRset ([RFC 4035][RFC 4035#section-2.2], section 2.2).\n\nThis test case will verify if the *Child Zone* meets that\nrequirement.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DS08_ALGO_NOT_SUPPORTED_BY_ZM]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[DS08_DNSKEY_RRSIG_EXPIRED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[DS08_DNSKEY_RRSIG_NOT_YET_VALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[DS08_MISSING_RRSIG_IN_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[DS08_NO_MATCHING_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[DS08_RRSIG_NOT_VALID_BY_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA RCODE List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RFC 4035#section-2.1]: https://datatracker.ietf.org/doc/html/rfc4035#section-2.1\n[RFC 4035#section-2.2]: https://datatracker.ietf.org/doc/html/rfc4035#section-2.2\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS08_DNSKEY_RRSIG_EXPIRED", "ZM_DS08_DNSKEY_RRSIG_NOT_YET_VALID", "ZM_DS08_MISSING_RRSIG_IN_RESPONSE", "ZM_DS08_NO_MATCHING_DNSKEY", "ZM_DS08_RRSIG_NOT_VALID_BY_DNSKEY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Valid RRSIG for DNSKEY" }, "dnssec-09" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html).\n\n# Objective\n\nIf the zone is signed, the SOA RR should be signed with a valid RRSIG\nusing a DNSKEY from the DNSKEY RR set. This is described\nin [RFC 4035][RFC 4035#section-2.2], section 2.2.\n\nThis test case will verify if the *Child Zone* meets that\nrequirement.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[Consistency01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency01.md\n[Consistency02]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency02.md\n[Consistency03]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency03.md\n[Consistency06]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Consistency-TP/consistency06.md\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC08]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.md\n[DS09_ALGO_NOT_SUPPORTED_BY_ZM]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[DS09_MISSING_RRSIG_IN_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[DS09_NO_MATCHING_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[DS09_RRSIG_NOT_VALID_BY_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[DS09_SOA_RRSIG_EXPIRED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[DS09_SOA_RRSIG_NOT_YET_VALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA RCODE List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RFC 4035#section-2.2]: https://datatracker.ietf.org/doc/html/rfc4035#section-2.2\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS09_MISSING_RRSIG_IN_RESPONSE", "ZM_DS09_NO_MATCHING_DNSKEY", "ZM_DS09_RRSIG_NOT_VALID_BY_DNSKEY", "ZM_DS09_SOA_RRSIG_EXPIRED", "ZM_DS09_SOA_RRSIG_NOT_YET_VALID" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "RRSIG(SOA) must be valid and created by a valid DNSKEY" }, "dnssec-10" : { "Description" : "\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html).\n\n# Objective\n\nWhen DNSSEC is enabled, NSEC or NSEC3 records provide a secure denial of\nexistence for records not present in the zone. This Test Case verifies that\ncorrect NSEC or NSEC3 records with valid signatures are returned for a query for\nan RR type that does not exist for that specific name (node in the DNS tree).\nThe existing RR types are listed in the [IANA RR Type List].\n\nFurthermore, it is verified that the name servers for the zone are consistent\nabout NSEC and NSEC3, i.e. either all servers should use NSEC or all servers\nshould use NSEC3. It is never permitted to serve both NSEC and NSEC3 for the\nsame zone.\n\nThe NSEC3PARAM RR that must exist in the zone (in apex, and apex only) if NSEC3\nis used, but must not exist in a zone using NSEC.\n\nThe use of the NSEC RR type is described in [RFC 4035][RFC 4035#section-3.1.3],\nsection 3.1.3, and the description of the NSEC RR itself is in\n[RFC 4034][RFC 4034#section-4], section 4.\n\nThe description of the NSEC3 and NSEC3PARAM RRs are found in\n[RFC 5155][RFC 5155#section-3], section 3, and [RFC 5155][RFC 5155#section-4],\nsection 4, respectively. The use of NSEC3 in the DNS response is described in\n[RFC 5155][RFC 5155#section-7.2], section 7.2.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNS Query and Response Defaults]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md\n[DNSSEC Query]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-setting-in-dnssec-query\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC Response]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSQueryAndResponseDefaults.md#default-handling-of-a-dnssec-response\n[DNSSEC05#objective]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.md#objective\n[DS10_ALGO_NOT_SUPPORTED_BY_ZM]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_ERR_MULT_NSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_ERR_MULT_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_ERR_MULT_NSEC3PARAM]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_EXPECTED_NSEC_NSEC3_MISSING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_HAS_NSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_HAS_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_INCONSISTENT_NSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_INCONSISTENT_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_INCONSISTENT_NSEC_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_MIXED_NSEC_NSEC3]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3PARAM_GIVES_ERR_ANSWER]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3PARAM_MISMATCHES_APEX]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3PARAM_QUERY_RESPONSE_ERR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_ERR_TYPE_LIST]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_MISMATCHES_APEX]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_MISSING_SIGNATURE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_NODATA_MISSING_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_NODATA_WRONG_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_NO_VERIFIED_SIGNATURE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_RRSIG_EXPIRED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_RRSIG_NOT_YET_VALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_RRSIG_NO_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC3_RRSIG_VERIFY_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_ERR_TYPE_LIST]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_GIVES_ERR_ANSWER]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_MISMATCHES_APEX]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_MISSING_SIGNATURE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_NODATA_MISSING_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_NODATA_WRONG_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_NO_VERIFIED_SIGNATURE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_QUERY_RESPONSE_ERR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_RRSIG_EXPIRED]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_RRSIG_NOT_YET_VALID]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_RRSIG_NO_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_NSEC_RRSIG_VERIFY_ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_SERVER_NO_DNSSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[DS10_ZONE_NO_DNSSEC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[Get-Del-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-delegation-ns-names-and-ip-addresses\n[Get-Zone-NS-Names-and-IPs]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/MethodsV2.md#method-get-zone-ns-names-and-ip-addresses\n[IANA RR Type List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[RFC 4034#section-4]: https://datatracker.ietf.org/doc/html/rfc4034#section-4\n[RFC 4035#section-3.1.3]: https://datatracker.ietf.org/doc/html/rfc4035#section-3.1.3\n[RFC 5155#section-3]: https://datatracker.ietf.org/doc/html/rfc5155#section-3\n[RFC 5155#section-4]: https://datatracker.ietf.org/doc/html/rfc5155#section-4\n[RFC 5155#section-7.2]: https://datatracker.ietf.org/doc/html/rfc5155#section-7.2\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[Test procedure]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec10.html#test-procedure\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS10_ERR_MULT_NSEC", "ZM_DS10_ERR_MULT_NSEC3", "ZM_DS10_ERR_MULT_NSEC3PARAM", "ZM_DS10_EXPECTED_NSEC_NSEC3_MISSING", "ZM_DS10_INCONSISTENT_NSEC", "ZM_DS10_INCONSISTENT_NSEC3", "ZM_DS10_INCONSISTENT_NSEC_NSEC3", "ZM_DS10_MIXED_NSEC_NSEC3", "ZM_DS10_NSEC3PARAM_GIVES_ERR_ANSWER", "ZM_DS10_NSEC3PARAM_MISMATCHES_APEX", "ZM_DS10_NSEC3PARAM_QUERY_RESPONSE_ERR", "ZM_DS10_NSEC3_ERR_TYPE_LIST", "ZM_DS10_NSEC3_MISMATCHES_APEX", "ZM_DS10_NSEC3_MISSING_SIGNATURE", "ZM_DS10_NSEC3_NODATA_MISSING_SOA", "ZM_DS10_NSEC3_NODATA_WRONG_SOA", "ZM_DS10_NSEC3_NO_VERIFIED_SIGNATURE", "ZM_DS10_NSEC3_RRSIG_EXPIRED", "ZM_DS10_NSEC3_RRSIG_NOT_YET_VALID", "ZM_DS10_NSEC3_RRSIG_NO_DNSKEY", "ZM_DS10_NSEC3_RRSIG_VERIFY_ERROR", "ZM_DS10_NSEC_ERR_TYPE_LIST", "ZM_DS10_NSEC_GIVES_ERR_ANSWER", "ZM_DS10_NSEC_MISMATCHES_APEX", "ZM_DS10_NSEC_MISSING_SIGNATURE", "ZM_DS10_NSEC_NODATA_MISSING_SOA", "ZM_DS10_NSEC_NODATA_WRONG_SOA", "ZM_DS10_NSEC_NO_VERIFIED_SIGNATURE", "ZM_DS10_NSEC_QUERY_RESPONSE_ERR", "ZM_DS10_NSEC_RRSIG_EXPIRED", "ZM_DS10_NSEC_RRSIG_NOT_YET_VALID", "ZM_DS10_NSEC_RRSIG_NO_DNSKEY", "ZM_DS10_NSEC_RRSIG_VERIFY_ERROR", "ZM_DS10_SERVER_NO_DNSSEC" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Zone contains NSEC or NSEC3 records" }, "dnssec-13" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html).\n\n# Objective\n\nFrom [RFC 6840][RFC 6840#section-5.11], section 5.11:\n\n> The DS RRset and DNSKEY RRset are used to signal which algorithms are used to\n> sign a zone. \\[...] The zone MUST also be signed with each algorithm (though\n> not each key) present in the DNSKEY RRset. \\[...]\n\nTo verify that the whole zone is signed with all algorithms require access to the\ncomplete zone, which is generally not possible for public zones. This test case\nis limited to three RRsets that must be present in a signed zone, the SOA RRset,\nthe NS RRset and the DNSKEY RRset.\n\nThis test case will verify that for each DNSKEY algorithm, there is a RRSIG of\nthat algorithm for the three selected RRsets.\n\n\n\n[Argument list]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/ArgumentsForTestCaseMessages.md\n[CRITICAL]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#critical\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC08]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec08.md\n[DNSSEC09]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec09.md\n[DS13_ALGO_NOT_SIGNED_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#summary\n[DS13_ALGO_NOT_SIGNED_NS]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#summary\n[DS13_ALGO_NOT_SIGNED_SOA]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec13.html#summary\n[ERROR]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#error\n[IANA RCODE List]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6\n[INFO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#info\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NOTICE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#notice\n[RFC 6840#section-5.11]: https://datatracker.ietf.org/doc/html/rfc6840#section-5.11\n[Severity Level Definitions]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md\n[WARNING]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/SeverityLevelDefinitions.md#warning\n[Zonemaster-Engine profile]: https://doc.zonemaster.net/v2025.2.1/configuration/profiles.md\n", "Errors" : [ "ZM_DS13_ALGO_NOT_SIGNED_DNSKEY", "ZM_DS13_ALGO_NOT_SIGNED_NS", "ZM_DS13_ALGO_NOT_SIGNED_SOA" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "All DNSKEY algorithms used to sign the zone" }, "dnssec-14" : { "Description" : "_**Note:** the severity levels of one or more error codes for this test case have been changed from the default._\n\nThis test case comes from version v2025.2.1 of Zonemaster. For more information, please refer to [the documentation for this test case](https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html).\n\n# Objective\n\nThe DNSKEYs based on RSA have different minimum and maximum key sizes,\nwhich must be followed. This test case will validate the keys size of \nsuch keys. RSA based algorithms that are deprecated or else not suitable \nfor DNSKEY ([RFC 8624] and [IANA registry]) are just ignored. See test \ncase [DNSSEC05] for test of algorithm.\n\nThe table 1 below specify the maximum and minimum key size, \nrespectively. Algorithm number can be found in [IANA registry].\n\nTable 1: Minimum and maximum RSA key sizes in bits\n\nAlgorithm | Min size | Max size | Reference\n:---------|:----------|:---------|:----------------\n5 | 512 | 4096 | [RFC 3110]\n7 | 512 | 4096 | [RFC 5155]\n8 | 512 | 4096 | [RFC 5702]\n10 | 1024 | 4096 | [RFC 5702]\n\nIt is also recommended that an RSA based algorithm has a key length \nof at least 2048 bit as stated in [NIST SP 800-57 Part 1 Rev. 4],\ntable 2 on page 53 in section 5.6.1 and table 4 on page 55 in \nsection 5.6.2.\n\nThis test case verifies that RSA DNSKEYs follows the stated key lengths\nfrom the RFCs and also the NIST recommended shortest key length.\n\n\n[Connectivity01]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Connectivity-TP/connectivity01.md\n[DNSKEY_SMALLER_THAN_REC]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[DNSKEY_TOO_LARGE_FOR_ALGO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[DNSKEY_TOO_SMALL_FOR_ALGO]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[DNSSEC README]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/README.md\n[DNSSEC05]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec05.md\n[IANA registry]: https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml\n[KEY_SIZE_OK]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[Method4]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-4-obtain-glue-address-records-from-parent\n[Method5]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/Methods.md#method-5-obtain-the-name-server-address-records-from-child\n[NIST SP 800-57 Part 1 Rev. 4]: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-4/archive/2016-01-28\n[NO_RESPONSE]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[NO_RESPONSE_DNSKEY]: https://doc.zonemaster.net/v2025.2.1/specifications/tests/DNSSEC-TP/dnssec14.html#outcomes\n[RFC 3110]: https://datatracker.ietf.org/doc/html/rfc3110\n[RFC 5155]: https://datatracker.ietf.org/doc/html/rfc5155\n[RFC 5702]: https://datatracker.ietf.org/doc/html/rfc5702#section-2\n[RFC 8624]: https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1\n[Recommendation for key Management, part 1, revision 4]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf\n", "Errors" : [ "ZM_DNSKEY_SMALLER_THAN_REC", "ZM_DNSKEY_TOO_LARGE_FOR_ALGO", "ZM_DNSKEY_TOO_SMALL_FOR_ALGO", "ZM_NO_RESPONSE", "ZM_NO_RESPONSE_DNSKEY" ], "Implemented" : true, "Maturity" : "GAMMA", "Summary" : "Check for valid RSA DNSKEY key size" }, "dnssec-91" : { "Description" : "In addition to the requirements outlined in `dnssec-05`, this test imposes\nan additional requirement on the signing algorithms used to sign zones.\n\nSpecifically, the algorithm number **MUST NOT** be lower than 8.\n", "Errors" : [ "DNSSEC_DNS_QUERY_ERROR", "DNSSEC_INVALID_SIGNING_ALGORITHM" ], "Maturity" : "GAMMA", "Summary" : "Permitted signing algorithms" }, "dnssec-92" : { "Description" : "The DS record(s) submitted in the `dnssec.dsRecords` input parameter will\nbe validated.\n\nThis test case will fail if any of the DS record(s) use algorithms #1\n(SHA-1) #12 (GOST R 34.10-2001).\n", "Errors" : [ "DNSSEC_DNS_QUERY_ERROR", "DNSSEC_INVALID_DIGEST_ALGORITHM" ], "Maturity" : "GAMMA", "Summary" : "Permitted DS record hash algorithm(s)" }, "dnssec-93" : { "Description" : "[RFC 9276](https://www.rfc-editor.org/rfc/rfc9276.html) defines best\npractice relating to the use of NSEC3 for Authenticated Denial of Existence.\nThis test case verifies that the zone's NSEC3 configuration complies with\nthis best practice.\n\nIf the zone does not use NSEC3, then this test will be skipped.\n\nThe `NSEC3PARAM` record will be checked to ensure that:\n\n* the value of the `iterations` field of the NSEC3 record is zero;\n* the value of the `salt` field of the NSEC3 record is empty (represented as\n a `-` in the presentation format).\n", "Errors" : [ "DNSSEC_DNS_QUERY_ERROR", "DNSSEC_NSEC3_ITERATIONS_IS_NOT_ZERO", "DNSSEC_NSEC3_SALT_IS_NOT_EMPTY" ], "Summary" : "NSEC3 iterations check" }, "dnssecOps01-ZSKRollover" : { "Description" : "This test case verifies the RSP's ability to perform a ZSK rollover (as\ndescribed in [Section 4.1.1 of\nRFC 6781](https://www.rfc-editor.org/rfc/rfc6781.html#section-4.1.1)).\n\nIf the value of the `dnssecOps.csk` input parameter is `true`, then this\ntest will be skipped.\n\nThe system will monitor the zone specified in the `dnssec.zskRolloverZone`\ninput parameter. The domain may be present anywhere in the global DNS\nhierarchy (that is, it does not need to be a TLD), but **MUST** have a\nsecure chain of trust up to the root zone, so that it can be validated using\nthe root zone trust anchor.\n\nThe zone **MUST** contain at least 10,000 delegations, where a delegation is\nconsidered to be one or more `NS` records with owner names that are below\nthe zone's origin. If NSEC3 is used for secure denial of existence, the\nopt-out flag `MUST NOT` be set *(that is, an `RRSIG` record should be\npresent for all `NS` rrsets, irrespective of whether a corresponding `DS`\nrecord is published)*.\n\nMonitoring will be carried out using `SOA` queries sent to multiple\nvalidating DNS resolvers, and by validating the result of a zone transfer\nfrom the server(s) specified in the `dnssecOps.primaryServers` input\nparameter.\n\nDuring the test period (currently defined as 48 hours) the operator\n**MUST** successfully carry out a ZSK rollover for the domain, where the\nZone Signing Key is replaced, without disrupting the chain of trust.\n\nThe original ZSK **MUST** additionally be unpublished (removed from the\nzone) before the end of the test period.\n\nTo simplify testing, applicants may wish to provision the zone such that it\nis configured with short TTLs and a short ZSK lifetime, so that a ZSK\nrollover is guaranteed to occur within the 48 test period.\n", "Errors" : [ "DNSSEC_OPS_DNS_QUERY_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_XFR_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_ZONE_IS_INVALID", "DNSSEC_OPS_ZSK_ROLLOVER_CHAIN_OF_TRUST_BROKEN", "DNSSEC_OPS_ZSK_ROLLOVER_NOT_COMPLETED", "DNSSEC_OPS_INVALID_ALGORITHM" ], "Implemented" : "", "Input-Parameters" : [ "dnssecOps.csk", "dnssecOps.zskRolloverZone" ], "Maturity" : "GAMMA", "Summary" : "ZSK rollover" }, "dnssecOps02-KSKRollover" : { "Description" : "This test case verifies the RSP's ability to perform a CSK/KSK rollover\n(as described in [Sections 4.1.2 and 4.13 of\nRFC 6781](https://www.rfc-editor.org/rfc/rfc6781.html#section-4.1.2)).\n\nThe system will monitor the zone specified in the `dnssec.kskRolloverZone`\ninput parameter. The domain may be present anywhere in the global DNS\nhierarchy (that is, it does not need to be a TLD), but **MUST** have a\nsecure chain of trust up to the root zone, so that it can be validated using\nthe root zone trust anchor.\n\nThe zone **MUST** contain at least 10,000 delegations, where a delegation is\nconsidered to be one or more `NS` records with owner names that are below\nthe zone's origin. If NSEC3 is used for secure denial of existence, the\nopt-out flag `MUST NOT` be set *(that is, an `RRSIG` record should be\npresent for all `NS` rrsets, irrespective of whether a corresponding `DS`\nrecord is published)*.\n\nMonitoring will be carried out using `SOA` queries sent to multiple\nvalidating DNS resolvers, and by validating the result of a zone transfer\nfrom the server(s) specified in the `dnssecOps.primaryServers` input\nparameter.\n\nDuring the test period (currently defined as 48 hours) the operator\n**MUST** successfully carry out a KSK rollover for the domain, where the\nKey Signing Key is replaced, and the DS record in the parent zone is\nupdated, without disrupting the chain of trust.\n\nThe DS record for the original KSK **MUST** additionally be removed from the\nparent zone before the end of the test period.\n\nTo simplify testing, applicants may wish to use a subdomain of\nan existing DNSSEC-signed zone under their control, so that completion of\nthe test is not dependent on interaction with a third party.\n", "Errors" : [ "DNSSEC_OPS_DNS_QUERY_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_XFR_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_ZONE_IS_INVALID", "DNSSEC_OPS_KSK_ROLLOVER_CHAIN_OF_TRUST_BROKEN", "DNSSEC_OPS_KSK_ROLLOVER_NOT_COMPLETED", "DNSSEC_OPS_INVALID_ALGORITHM" ], "Implemented" : "", "Input-Parameters" : [ "dnssecOps.kskRolloverZone" ], "Maturity" : "GAMMA", "Summary" : "KSK rollover" }, "dnssecOps03-AlgorithmRollover" : { "Description" : "This test case verifies the RSP's ability to perform an algorithm rollover\n(as described in [Section 4.1.4 of\nRFC 6781](https://www.rfc-editor.org/rfc/rfc6781.html#section-4.1.4)).\n\nThe system will monitor the zone specified in the `dnssec.algorithmRolloverZone`\ninput parameter. The domain may be present anywhere in the global DNS\nhierarchy (that is, it does not need to be a TLD), but **MUST** have a\nsecure chain of trust up to the root zone, so that it can be validated using\nthe root zone trust anchor.\n\nThe zone **MUST** contain at least 10,000 delegations, where a delegation is\nconsidered to be one or more `NS` records with owner names that are below\nthe zone's origin. If NSEC3 is used for secure denial of existence, the\nopt-out flag `MUST NOT` be set *(that is, an `RRSIG` record should be\npresent for all `NS` rrsets, irrespective of whether a corresponding `DS`\nrecord is published)*.\n\nMonitoring will be carried out using `SOA` queries sent to multiple\nvalidating DNS resolvers, and by validating the result of a zone transfer\nfrom the server(s) specified in the `dnssecOps.primaryServers` input\nparameter.\n\nDuring the test period (currently defined as 48 hours) the operator\n**MUST** successfully carry out an algorithm rollover for the domain\n(including an update to the DS record in the parent zone), where the\nalgorithm used to secure the domain is changed, without disrupting the\nchain of trust.\n\nThe DS record for the original KSK **MUST** additionally be removed from the\nparent zone before the end of the test period.\n\nNote that the specific algorithms being rolled to and from are not\nsignificant (although they **MUST** be present in the IANA registry and\ncomply with all other requirements specified in the DNSSEC test suite); it\nis not required that the new algorithm be more \"secure\" than the original\nalgorithm; only that they are different. So for example, a rollover from\nalgorithm 13 (`ECDSAP256SHA256`) to algorithm 8 (`RSASHA256`) will be\naccepted as well as a rollover from `RSASHA256` to `ECDSAP256SHA256`.\n\nTo simplify testing, applicants may wish to use a subdomain of\nan existing DNSSEC-signed zone under their control, so that completion of\nthe test is not dependent on interaction with a third party.\n", "Errors" : [ "DNSSEC_OPS_DNS_QUERY_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_XFR_FAILED_TOO_MANY_TIMES", "DNSSEC_OPS_ZONE_IS_INVALID", "DNSSEC_OPS_ALGORITHM_ROLLOVER_CHAIN_OF_TRUST_BROKEN", "DNSSEC_OPS_ALGORITHM_ROLLOVER_NOT_COMPLETED", "DNSSEC_OPS_INVALID_ALGORITHM" ], "Implemented" : "", "Input-Parameters" : [ "dnssecOps.algorithmRolloverZone" ], "Maturity" : "GAMMA", "Summary" : "algorithm rollover" }, "epp-01" : { "Description" : "This test confirms that the EPP service is reachable from the probe\nservers.\n\n1. At least one `A` record **MUST** be published in the DNS for the EPP\n hostname, to allow IPv4-only hosts to connect to the EPP service.\n2. At least one `AAAA` record **SHOULD** be published in the DNS for the\n EPP hostname, to allow IPv6-only hosts to connect to the EPP service.\n3. EPP is associated with TCP port 700. All IPv4/IPv6 addresses published\n in the DNS for the EPP hostname **MUST** accept TCP connections on this\n port. Since the EPP specification requires IP-based access control, the\n RSP **MUST** configure their firewall to allow access from the IP\n addresses listed in the `epp.clientACL` resource.\n4. EPP uses TLS to secure the channel between client and server. All\n service ports **MUST** support TLSv1.2 and optionally any subsequent\n protocol published by the IETF.\n5. TLSv1.1 and all previous versions have known security issues and **MUST\n NOT** be supported by any service ports.\n6. To ensure that the connection can be trusted, all service ports\n **MUST** present a certificate issued by a trusted CA, such as those\n supported by major browsers.\n7. All TLS certificates **MUST NOT** have expired, and **MUST** be\n presented wth any required intermediate certificates.\n8. The EPP server name **MUST** match at least one `subjectAltName` field\n in all presented certificates (either exact match or wildcard).\n9. Service ports **MUST** use at least one of the ciphers recommended in\n [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325.html) (or any successor\n document).\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_MISSING_A_RECORDS", "EPP_MISSING_AAAA_RECORDS", "EPP_TLS_REQUIRED_PROTOCOL_NOT_SUPPORTED", "EPP_TLS_FORBIDDEN_PROTOCOL_SUPPORTED", "EPP_TLS_UNTRUSTED_CERTIFICATE", "EPP_TLS_EXPIRED_CERTIFICATE", "EPP_TLS_CERTIFICATE_CHAIN_MISSING", "EPP_TLS_CERTIFICATE_HOSTNAME_MISMATCH", "EPP_TLS_BAD_CIPHER" ], "Maturity" : "GAMMA", "Resources" : [ "epp.tlsCertificateStore" ], "Summary" : "Service connectivity test" }, "epp-02" : { "Description" : "Once a connection is established, all service ports **MUST** send a\nvalid `` frame to the client.\n\n1. The `` element in the `` **MUST** identify the EPP\n server.\n2. The `` element in the `` **MUST** specify a time\n within 30 seconds of the current date and time as received from the NTP\n network.\n3. There **MUST** be exactly one `` element in the and\n it **MUST** contain exactly `1.0`.\n4. All `` element(s) in the `` **MUST** contain valid\n language codes. At least `en` **MUST** be included.\n5. All `` element(s) in the `` **MUST** contain XML\n namespace URIs that are appropriate. The only mandatory URI that\n **MUST** be present is the domain namespace URI. The host and contact\n namespace URIs may be required depending on the `epp.hostModel` and\n `general.registryDataModel` parameters.\n6. All `` and `` element(s) in the `` **MUST**\n correspond to entries in the EPP Extension Registry.\n7. `` elements containing the following XML namespaces **MUST** be\n present in the ``:\n * `urn:ietf:params:xml:ns:secDNS-1.1`\n * `urn:ietf:params:xml:ns:rgp-1.0`\n8. Unless the test plan is\n [`StandardRSPChangeTest`](#Test-Plan-StandardRSPChangeTest), an\n `` element containing `urn:ietf:params:xml:ns:launch-1.0`\n **MUST** be present in the `.\n\nThis test case will produce the `EPP_GREETING_RECOMMENDED_EXTENSION_MISSING`\nwarning if any of the following XML namespace URIs are not included in the\n`` element:\n\n* `urn:ietf:params:xml:ns:epp:secure-authinfo-transfer-1.0`\n* `urn:ietf:params:xml:ns:epp:unhandled-namespaces-1.0`\n* `urn:ietf:params:xml:ns:epp:loginSec-1.0`\n* `urn:ietf:params:xml:ns:changePoll-1.0`\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_NO_GREETING_RECEIVED", "EPP_GREETING_SVID_INVALID", "EPP_GREETING_SVDATE_INVALID", "EPP_GREETING_VERSION_INVALID", "EPP_GREETING_INVALID_LANG", "EPP_GREETING_MISSING_EN_LANG", "EPP_GREETING_UNEXPECTED_OBJURI", "EPP_GREETING_MISSING_OBJURI", "EPP_GREETING_UNEXPECTED_EXTURI", "EPP_GREETING_MISSING_EXTURI", "EPP_GREETING_RECOMMENDED_EXTENSION_MISSING" ], "Maturity" : "GAMMA", "Summary" : "Protocol conformance test" }, "epp-03" : { "Description" : "This test case validates the server's implementation of client\nauthentication. The client will submit a series of `` commands to\nconfirm that:\n\n1. the server rejects a `` command with a (randomly generated) non-\n existent client ID;\n2. the server rejects a `` command with a valid client ID, but an\n invalid password;\n3. the server rejects a `` command with a valid client ID and\n password but uses an incorrect client certificate;\n4. the server rejects a `` command with a valid client ID and\n password but uses the client certificate of another registrar;\n5. the server rejects a `` command with a valid client ID and\n password but without a client certificate;\n6. the server accepts a `` command with a valid client ID, password\n and client certificate;\n\nThe client will use the object and extension XML namespaces from the\nserver's `` in the `` command.\n\nIf the server supports the Login Security Extension (see [RFC\n8807](https://www.rfc-editor.org/rfc/rfc8807.html)) then this will be used\nby the client.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_UNEXPECTEDLY_FAILED", "EPP_LOGIN_UNEXPECTEDLY_SUCCEEDED", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Authentication test" }, "epp-04" : { "Description" : "The client will perform a series of `` commands and will validate\nthe server response, using (a) syntactically invalid domain names, (b) valid\nbut registered domain names (the names provided in the `epp.registeredNames`\ninput parameter will be used to test this) and (c) syntactically valid\nunregistered domains name generated using random characters.\n\nA \"syntactically valid\" domain name is one that complies with the format\nspecified in [RFC 1123](https://www.rfc-editor.org/rfc/rfc1123.html). This\ntest case does not consider IDN names.\n\nFor syntactically valid domain names, the server response **MUST** include\na `` element with an `avail` attribute with the appropriate\nboolean value.\n\nFor syntactically *invalid* domain names, the server response **MUST**\neither (a) respond normally and contain a `` element with an\n`avail` attribute with a value of `0` or `false`, **OR** return an error\nresponse with a 2001, 2004 or 2005 result code.\n\nChecks will be carried out for all TLDs in the TLD set whose `idnOnly`\nproperty is `false`. If a TLD's `idnOnly` property is `true` then that TLD\nwill be skipped (the functionality of the `` command for these TLDs\nwill be checked in the `idn-01` test case).\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_DOMAIN_CHECK_VALID_DOMAIN_INCORRECT_AVAIL", "EPP_DOMAIN_CHECK_INVALID_DOMAIN_INCORRECT_AVAIL", "EPP_DOMAIN_CHECK_REGISTERED_DOMAIN_INCORRECT_AVAIL", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-05" : { "Description" : "If the EPP server supports host objects, this test will perform a series\nof `` commands and will validate the the server response.\n\n* syntactically invalid hostname: either a normal response with an `avail`\n attribute of `0` or `false`, or an error response with a 2001, 2004 or\n 2005 result code.\n* valid but registered hostname: `avail` attribute **MUST** be `0` or\n `false`.\n* syntactically valid and unregistered hostname: `avail` attribute\n **MUST** be `1` or `true`. The hostname will be generated using random\n characters.\n\nA \"syntactically valid\" hostname is one that complies with the format\nspecified in [RFC 1123](https://www.rfc-editor.org/rfc/rfc1123.html) (this\ntest case does not consider IDN names).\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will be\nskipped.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_HOST_CHECK_VALID_HOST_INCORRECT_AVAIL", "EPP_HOST_CHECK_INVALID_HOST_INCORRECT_AVAIL", "EPP_HOST_CHECK_REGISTERED_HOST_INCORRECT_AVAIL", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "epp.registeredNameservers" ], "Maturity" : "GAMMA", "Summary" : "Host command test (if applicable)" }, "epp-06" : { "Description" : "If the EPP server supports contact objects, this test will perform a\nseries of `` commands and will validate the `avail` attribute of\nthe `` elements in the server response, as follows:\n\n* syntactically invalid ID: either a normal response with an `avail`\n attribute of `0` or `false`, or an error response with a 2001, 2004 or\n 2005 result code.\n* valid but registered ID: `avail` attribute **MUST** be `0` or\n `false`.\n* valid and unregistered ID: `avail` attribute **MUST** be `1` or\n `true`. The ID will be generated using random characters.\n\nIf the `general.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_CONTACT_CHECK_VALID_CONTACT_ID_INCORRECT_AVAIL", "EPP_CONTACT_CHECK_INVALID_CONTACT_ID_INCORRECT_AVAIL", "EPP_CONTACT_CHECK_REGISTERED_CONTACT_ID_INCORRECT_AVAIL", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "epp.registeredContacts" ], "Maturity" : "GAMMA", "Summary" : "Contact command test (if applicable for the registry type)" }, "epp-07" : { "Data-Providers" : [ "epp-07-data" ], "Description" : "This test attempts to create a number of contact objects, and validates\nthe server's response. For example, the test will expect that the server\nwill reject a command that creates an object with missing or invalid\nproperties, but will accept a command to create an object with valid\nproperties. Property values will be randomly generated but will contain\nrealistic values. No personal information will be transmitted as part\nof this test.\n\nIf the `general.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n\nThe test will confirm that the server checks and validates the values of\nthe following mandatory elements against the XML schema provided in RFC\n5733:\n\n* `` element\n* `` element(s):\n * `` element\n * `` element\n * `` element\n* `` element\n\nDepending on the list of elements provided in the `epp.supportedContactElements`\ninput parameter, the test will also confirm that the server checks and\nvalidates the values of the following optional elements:\n\n* `` element(s):\n * `` element\n * `` element(s)\n * `` element\n * `` element\n* `` element\n * `ext` attribute of the `` element\n* `` element\n * `ext` attribute of the `` element\n\n* The server **MUST NOT** accept a `` element that\n contains a value that is not a valid `clIDType` value;\n* The server **MUST NOT** accept a `` element that\n contains a `type` attribute that is neither `int` nor `loc`;\n* The server **MUST NOT** accept a `` element that contains a\n value that is not a valid ISO 3166-1 alpha-2 code;\n* The server **MUST NOT** accept a `` element that contains\n a value that does not conform to the format specified in [RFC\n 5322](https://www.rfc-editor.org/rfc/rfc5322.html);\n* If supported, the server **MUST NOT** accept a `` element\n that contains a value that does not conform to the format described in\n Section 2.5 of [RFC 5733](https://www.rfc-editor.org/rfc/rfc5733.html).\n\nOnce objects have been created, the client will then perform ``\ncommands to verify that the server has correctly stored the provided\nvalues.\n", "Errors" : [ "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CC", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CITY", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_EMAIL", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ID", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_NAME", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ORG", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_PC", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_POSTALINFO_TYPE", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_SP", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STREET", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE_EXT", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX", "EPP_CONTACT_CREATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX_EXT", "EPP_CONTACT_CREATE_INFO_RESPONSE_NOT_1000", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CC", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_CITY", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_EMAIL", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_NAME", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_VOICE", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_EMPTY_FAX", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CC", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_CITY", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_EMAIL", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ID", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_NAME", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_ORG", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_STREET", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_VOICE", "EPP_CONTACT_CREATE_SERVER_ACCEPTS_INVALID_FAX", "EPP_DNS_RESOLUTION_ERROR", "EPP_LOGIN_ERROR", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Contact command test (if applicable for the registry type)" }, "epp-08" : { "Description" : "This test will confirm that EPP clients are unable to perform `` and\n`` commands on objects that they do not sponsor.\n\nIf the `general.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n\nThe client will connect to the server and create contact objects. These\n`` commands **MUST** be successful.\n\nIt will then connect using a set of alternate credentials and submit\n`` and `` commands on the contact objects created in `epp-07`.\n\nThe server **MUST** reject these commands.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_CONTACT_INFO_RESPONSE_NOT_REJECTED", "EPP_CONTACT_UPDATE_RESPONSE_NOT_REJECTED", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Contact object access control (if applicable)" }, "epp-09" : { "Data-Providers" : [ "epp-09-postalinfo-data", "epp-09-other-data", "epp-09-status-data" ], "Description" : "This test will perform `` commands on the contact objects and will\nconfirm that the server correctly rejects invalid commands (which would\nspecify invalid property values) and accepts valid commands.\n\nIf the `general.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n\nThe test will confirm that the server checks and validates ``\ncommands which transform the values of the following elements:\n\n* ``\n* `` elements (both `int` and `loc`)\n * ``\n * `` (if supported)\n * `` elements\n * `` element(s) (if supported)\n * `` element\n * `` element (if supported)\n * `` element (if supported)\n * `` element\n* `` (if supported)\n * `ext` attribute of `` (if supported)\n* `` (if supported)\n * `ext` attribute of `` (if supported)\n* ``\n\nOnce objects have been updated, the client will then perform ``\ncommands to verify that the server has correctly stored the provided\nvalues.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_POSTALINFO_TYPE", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_ORG", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STREET", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CITY", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_SP", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_PC", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_CC", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_VOICE", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_FAX", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_EMAIL", "EPP_CONTACT_UPDATE_INFO_RESPONSE_NOT_1000", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ID", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STATUS", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_POSTALINFO_TYPE", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_NAME", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_ORG", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_STREET", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CITY", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_SP", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_PC", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_CC", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_VOICE_EXT", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_FAX_EXT", "EPP_CONTACT_UPDATE_INFO_RESPONSE_MISSING_OR_INCORRECT_EMAIL", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_NAME", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CITY", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_EMPTY_CC", "EPP_CONTACT_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE", "EPP_UNEXPECTED_COMMAND_SUCCESS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Contact command test (if applicable for the registry type)" }, "epp-10" : { "Description" : "This test will perform `` commands on contact objects, and will\nconfirm that the server accepts the `` command with a `1xxx`\nresponse code.\n\nIf the `general.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n\nOnce the `` commands have been submitted, the client will perform\n`` commands to confirm that the objects have actually been removed\nfrom the repository. If the response to the previous `` command\nwas 1001, this step will be skipped.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_CONTACT_DELETE_RESPONSE_NOT_1000_OR_1001", "EPP_CONTACT_DELETE_OBJECT_STILL_EXISTS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : null, "Maturity" : "GAMMA", "Summary" : "Contact command test (if applicable for the registry type)" }, "epp-11" : { "Data-Providers" : [ "epp-11-data" ], "Description" : "This test attempts to create a number of host objects, and validates\nthe server's response. For example, the test will expect that the server\nwill reject a command that creates an object with missing or invalid\nproperties, but will accept a command to create an object with valid\nproperties. Property values will be randomly generated but will contain\nrealistic values. No personal information will be transmitted as part\nof this test.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe test will confirm that the server checks and validates the values of\nthe following elements:\n\n* `` (both internal and external, for each TLD in the TLD\n set)\n* `` elements (both IPv4 and IPv6)\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe client will then perform `` commands on the objects successfully\ncreated to confirm that the server has correctly stored the provided\nvalues.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_HOSTNAME", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS", "EPP_HOST_CREATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS", "EPP_HOST_CREATE_INFO_RESPONSE_OBJECT_DOES_NOT_EXIST", "EPP_HOST_CREATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_UNEXPECTED_COMMAND_SUCCESS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host command test (if applicable)" }, "epp-12" : { "Description" : "This test will confirm that EPP clients are unable to perform ``\ncommands on objects that they do not sponsor.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe client will create a host object, and then use a set of alternate\ncredentials to submit `` commands on that object. The server\n**MUST** respond with a 2201 \"authorization error\" response.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_HOST_UPDATE_AUTHZ_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host object access control (if applicable)" }, "epp-13" : { "Data-Providers" : [ "epp-13-status-data", "epp-13-addr-data" ], "Description" : "This test will perform `` commands on host objects to confirm that\nthe server correctly rejects invalid commands (which would specify invalid\nproperty values) and accepts valid commands.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe test will create host objects with pseudo-randomly generated \"internal\"\nnames and confirm that the server checks and validates `` commands\nwhich transform the values of the following elements:\n\n* ``\n* ``\n\nNote: the server's ability to support host renames is checked in a later\ntest.\n\nThe client will then perform `` commands on the objects successfully\nupdated to confirm that the server has correctly stored the updated\nvalues.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPV4_ADDRESS", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_IPv6_ADDRESS", "EPP_HOST_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE", "EPP_HOST_UPDATE_INFO_RESPONSE_OBJECT_DOES_NOT_EXIST", "EPP_HOST_UPDATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_UNEXPECTED_COMMAND_SUCCESS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host command test (if applicable)" }, "epp-14" : { "Data-Providers" : [ "epp-14-data" ], "Description" : "This test performs a series of domain `` commands, using pseudo-\nrandom syntactically valid ASCII domain names under each TLD in the TLD set.\n\nDepending on the value of the `general.registryDataModel` and\n`epp.requiredContactTypes` input parameters, contact objects may be created\n(using pseudo-random contact information) beforehand, to be used as the\nregistrant (and other) contacts.\n\nIf the `epp.hostModel` parameter is `objects`, then host objects with\nsyntactically valid pseudo-random names will be created and used as the\nnameservers (otherwise the names will be provided as attributes).\n\nThe client will use `` commands to test aspects of the server's\nprocessing of those commands, for example:\n\n* to confirm that the server does not accept invalid values for object\n properties (such as domain name, registration period, registant ID,\n nameservers, and DS record parameters). Examples:\n * invalid domain\n * invalid period (1-10 years)\n * invalid host attributes (if applicable)\n * host attributes with subordinate names and missing glue (if\n applicable)\n * invalid DS/keyData record parameters (keyTag, algorithm, digest type,\n and malformed digest)\n* to confirm that the server does not accept commands which reference\n non-existent host/contact objects (if applicable)\n* to confirm that the server rejects a `` command which\n specifies a registrant contact (where the `general.registryDataModel`\n input parameter is `minimum` or `per-registrar`)\n* to confirm that the server rejects a `` command which does not\n specify a registrant contact (where the `general.registryDataModel` input\n parameter is `maximum` or `per-registrar`)\n* to confirm that the server rejects a `` command containing\n host objects when the `epp.hostModel` parameter is `attributes`\n* to confirm that the server rejects a `` command containing\n host attributes when the `epp.hostModel` parameter is `objects`\n* to confirm that the the server which implements [RFC\n 9154](https://www.rfc-editor.org/rfc/rfc9154.html) accepts a ``\n command with an empty `` element.\n\nBoth registrar IDs (those specified in the `epp.clid01` and `epp.clid02`\ninput parameters) will be used to create domains.\n\nIf the value of the `general.registryDataModel` input parameter is\n`per-registrar`, then the `epp.clid01DataModel` and `epp.clid02DataModel`\ninput parameters will be taken into consideration when determining whether\ncontact objects are needed to successfully create a domain name.\n\nOnce the `` commands have been processed, the client will then\nperform `` commands to confirm that:\n\n* the `` element is valid and contains a repository ID registered\n with IANA;\n* the `` and `` elements are present and valid;\n* the `` and `` elements match the client ID used to create\n the domain.\n* DNSSEC information provided in the `` command is present and\n correct.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DOMAIN_NAME", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_PERIOD", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_HOST_OBJECT", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITH_INVALID_GLUE", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NON_EXISTENT_REGISTRANT", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_MISSING_REGISTRANT", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NON_EXISTENT_HOST_OBJECT", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_REGISTRANT_FOR_THIN_REGISTRY", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_NO_REGISTRANT_FOR_THICK_REGISTRY", "EPP_DOMAIN_CREATE_SERVER_INCORRECTLY_ACCEPTS_HOST_ATTRIBUTES", "EPP_DOMAIN_CREATE_SERVER_INCORRECTLY_ACCEPTS_HOST_OBJECTS", "EPP_DOMAIN_CREATE_SERVER_ACCEPTS_AUTHINFO", "EPP_DOMAIN_CREATE_INFO_RESPONSE_INVALID_ROID", "EPP_DOMAIN_CREATE_INFO_RESPONSE_MISSING_OBJECT_PROPERTIES", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-15" : { "Description" : "This test confirms that the EPP server will refuse a request to delete a\nlinked object.\n\nIf the `epp.hostModel` input parameter is `attributes`, **and** the\n`general.registryDataModel` input parameter is `minimum`, then this test\nwill be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `epp.clid01DataModel` and\n`epp.clid02DataModel` input parameters.\n\nThe client will create contact and/or host objects using pseudo-randomly\ngenerated properties, and then create a domain object that uses those\nobjects.\n\nIt will then submit `` commands for those contact and host objects\nThe server **MUST** reject these commands.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_INTEGRITY_SERVER_ACCEPTS_DELETE_FOR_LINKED_CONTACT_OBJECT", "EPP_INTEGRITY_SERVER_ACCEPTS_DELETE_FOR_LINKED_HOST_OBJECT", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Registry object integrity test (if applicable)" }, "epp-16" : { "Data-Providers" : [ "epp-16-status-data", "epp-16-ns-data", "epp-16-dnssec-data" ], "Description" : "This test will confirm that the client is able to perform ``\ncommands on domain names, including:\n\n* adding and removing client-assigned status codes\n* adding and removing nameservers (whether objects or attributes)\n* changing registrant object (if applicable)\n* adding and remove DNSSEC information\n\nThe client will create a domain name (and any contact and/or host objects\nrequired) and perform `` commands as described above.\n\nIt will then perform `` commands to confirm that the changes have been\ncorrectly stored by the server.\n\nThe client will then confirm that the server rejects `` commands\nthat use host objects if the value of the `epp.hostModel` input parameter\nis `attributes`, and host attributes if its value is `objects`.\n\nThe client will also confirm that it cannot perform an `` command\non a domain sponsored by another registrar, and that the server responds\nwith a `2201` authorization error.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_HOST_ATTRIBUTES", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_HOST_ATTRIBUTES_WITHOUT_GLUE", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_DNSSEC_DATA", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_NON_EXISTENT_CONTACT_OBJECT", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_NON_EXISTENT_HOST_OBJECT", "EPP_DOMAIN_UPDATE_SERVER_INCORRECTLY_ACCEPTS_HOST_ATTRIBUTES", "EPP_DOMAIN_UPDATE_SERVER_INCORRECTLY_ACCEPTS_HOST_OBJECTS", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_STATUS_CODE", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_STATUS_CODE", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_HOST_OBJECT", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_HOST_OBJECT", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_HOST_ATTRIBUTE", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_HOST_ATTRIBUTE", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_REGISTRANT", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_REGISTRANT", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_UNEXPECTED_DNSSEC_DATA", "EPP_DOMAIN_UPDATE_INFO_RESPONSE_MISSING_DNSSEC_DATA", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_UNEXPECTED_COMMAND_SUCCESS", "EPP_DOMAIN_UPDATE_SERVER_ACCEPTS_INVALID_STATUS_CODE", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-17" : { "Description" : "This test confirms that all EPP service ports respond with consistent object\ninformation.\n\nThe client will establish separate connections to each EPP service port\n(defined as TCP port 700 on all IP addresses found in the `A` and `AAAA`\nrecords for the EPP server name) and, using one of these connections,\ncreate a domain name, and any contact and/or host objects, as required.\n\nIt will then perform `` commands on those object(s) on each of the\nother ports. In all cases, the server **MUST** respond with a `1000`\nresponse, and the content of the `` element of the response\n**MUST** be identical on all service ports.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_SERVICE_PORT_NOT_CONSISTENT", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Service Port consistency test" }, "epp-18" : { "Description" : "This test will confirm that the client is able to renew domain names.\n\nThe client will create a domain name, and any contact and/or host objects,\nas required, then submit `` commands for that object.\n\n1. Following a succesful `` command, the expiry date of the domain\n **MUST** have been increased by the period specified by the client;\n2. The domain **MUST** have an RGP status of `renewPeriod`;\n3. The server **MUST** reject a `` command if it would result in\n the expiry date being more than 10 years into the future.\n\nAfter each `` command, the client will perform an `` command to\nensure that the expiry date and RGP status of the domain are set correctly.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_RENEW_SERVER_ACCEPTS_INVALID_PERIOD", "EPP_RENEW_SERVER_ACCEPTS_INVALID_CURRENT_EXPIRY_DATE", "EPP_RENEW_INFO_RESPONSE_UNEXPECTED_EXPIRY_DATE", "EPP_RENEW_INFO_RESPONSE_MISSING_OR_INVALID_RGP_STATUS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-19" : { "Description" : "This test will confirm that the client is able to initiate a domain\ntransfer.\n\nThe client will create a domain name, and any contact and/or host objects,\nas required.\n\nThe client will then perform an `` command to set an authInfo code.\n\nIf the server implements [RFC\n9154](https://www.rfc-editor.org/rfc/rfc9154.html), it **MUST** reject the\n`` command if the authInfo code is insufficently secure.\n\nThen, using a second set of credentials, the client will connect to the\nEPP server and authenticate, submit `` commands, and validate\nthe responses.\n\nThis test will confirm that:\n\n* the server rejects a `` command with an invalid authInfo code;\n* the server rejects a command which would extend the domain's validity\n period more than 10 years into the future;\n* the server accepts a `` command with a valid authInfo code\n and period.\n\nThe client will use `` commands to ensure that the `pendingTransfer`\nstatus code is added to the domain within 120 seconds of a successul\ntransfer request.\n\nThe client will also use `` commands to confirm that, within 120\nseconds of a transfer being approved by the losing registrar:\n\n* the domain is under the sponsorship of the gaining registrar;\n* the authInfo code has been reset by the server (if the server supports\n [RFC 9154](https://www.rfc-editor.org/rfc/rfc9154.html));\n* the domain has the `transferPeriod` RGP status.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_DOMAIN_TRANSFER_REQUEST_FAILED", "EPP_TRANSFER_SERVER_ACCEPTS_INSECURE_AUTHINFO", "EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO", "EPP_TRANSFER_SERVER_ACCEPTS_INCORRECT_AUTHINFO", "EPP_TRANSFER_SERVER_ACCEPTS_INVALID_PERIOD", "EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_STATUS_CODE", "EPP_TRANSFER_INFO_RESPONSE_UNEXPECTED_EXPIRY_DATE", "EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_RGP_STATUS", "EPP_TRANSFER_INFO_RESPONSE_AUTHINFO_NOT_RESET", "EPP_GENERIC_COMMAND_ERROR", "EPP_TRANSFER_NOT_PROCESSED", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-20" : { "Description" : "This test confirms that the server behaves correctly if the sponsoring\nregistrar of a domain rejects a transfer request.\n\nThe test procedure matches that of `epp-19`, but the transfer request will\nbe rejected rather than approved.\n\nAn `` command will be used to confirm that the domain name remains\nunder the sponsorship of the original registrar, and that the domain does\nnot have the `pendingTransfer` status.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_TRANSFER_SERVER_PROCESSED_REJECTED_TRANSFER", "EPP_TRANSFER_SERVER_REJECTS_SECURE_AUTHINFO", "EPP_TRANSFER_SERVER_ACCEPTS_INCORRECT_AUTHINFO", "EPP_TRANSFER_INFO_RESPONSE_MISSING_OR_INVALID_STATUS_CODE", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain rejection test" }, "epp-21" : { "Description" : "This test will create and then delete a domain name, to confirm that the\nserver accepts the `` command with a `1xxx` response code.\n\nOnce the `` command has been processed, the client will perform\nand `` command to confirm that:\n\n* if the server responded to the `` command with a `1000`\n response, then the domain no longer exists;\n* if the server responded to the `` command with a `1001`\n response, then (a) the domain no longer exists (as it has been purged) or\n (b) the domain has the `pendingDelete` status.\n\nIf the `` command resulted in a `1000` response, the client will\nalso submit `` commands for any host and/or contact objects created.\nThese commands **MUST** succeed, and an `` command for them **MUST**\nresult in a `2303` \"object does not exist\" error.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_DOMAIN_DELETE_INFO_RESPONSE_OBJECT_STILL_EXISTS", "EPP_DOMAIN_DELETE_INFO_RESPONSE_OBJECT_NOT_PENDING_DELETE", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain command test" }, "epp-23" : { "Data-Providers" : [ "epp-23-data" ], "Description" : "This tests verifies the server's support for host rename operations.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe client will create host one or more host objects and the perform\n`` commands to confirm that the server correctly accepts or rejects\nthose commands, for example:\n\n* an `` command which specifies a syntactically invalid host name\n is rejected;\n* an `` command which places the object in a different top-level\n domain (that uses a different EPP repository) is accepted;\n* an `` command which places the object within a non-existent\n domain in the same TLD is rejected;\n* an `` command which places the object within a domain sponsored\n by another registrar is rejected. The domain name(s) provided in the\n `epp.registeredNames` parameter will be used for this test. A ``\n command will be used to confirm that the domain exists before the\n `` command is submitted.\n* an `` command which places the object within a domain sponsored\n by the test client is accepted.\n* an `` command changes the name of an external host object that has\n associations with objects that are sponsored by a different client *MUST*\n fail with error code 2305.\n\nThe client will then perform `` commands on the objects successfully\nupdated, to confirm that the server has correctly stored the updated\nvalues.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_HOST_RENAME_SERVER_ACCEPTS_INVALID_HOSTNAME", "EPP_HOST_RENAME_SERVER_REJECTS_EXTERNAL_NAME", "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_NONEXISTENT_DOMAIN", "EPP_HOST_RENAME_SERVER_ACCEPTS_RENAME_TO_ANOTHER_REGISTRARS_DOMAIN", "EPP_HOST_RENAME_SERVER_UNEXPECTEDLY_REJECTS_RENAME", "EPP_GENERIC_COMMAND_ERROR", "EPP_HOST_RENAME_OBJECT_NOT_RENAMED", "EPP_INVALID_EXTENSION", "EPP_HOST_RENAME_SERVER_INCORRECTLY_ACCEPTS_RENAME" ], "Maturity" : "GAMMA", "Summary" : "Host rename test (if applicable)" }, "epp-24" : { "Description" : "This test will perform create host objects and then confirm that the server\nresponds to a `` command with a `1xxx` response code.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nOnce the `` commands have been submitted, if a `1000` response was\nreceived from the server, the client will perform `` commands to\nconfirm that the objects have been deleted.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_HOST_DELETE_RESPONSE_NOT_1000_OR_1001", "EPP_HOST_DELETE_INFO_RESPONSE_OBJECT_STILL_EXISTS", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host command test (if applicable)" }, "epp-25" : { "Description" : "This test will confirm that the EPP server implements security controls\nrelated to the creation of host objects that are subordinate to domain names\nthat are sponsored by a different client.\n\nIf the `epp.hostModel` input parameter is `attributes`, this test will\nbe skipped.\n\nThe test client will connect to the EPP server, authenticate, and create\na domain name and any required contact objects.\n\nThen, using a second set of credentials, the client will connect to the\nEPP server, authenticate, and `` commands for host objects that are\nsubordinate to the previously created domain name.\n\nOne command will specify one or more IPv4 or IPv6 address for the object.\nThis command **MUST** be rejected by the server.\n\nOne command will not specify any IPv4 or IPv6 addresses for the object. If\nthe command succeeds, a subsequent `` command **MUST** show that the\nresulting host object is sponsored by the same client that sponsors the\nsuperordinate domain object.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_INVALID_EXTENSION", "EPP_UNEXPECTED_HOST_CREATE_SUCCESS", "EPP_HOST_CREATE_INCORRECT_CLID" ], "Maturity" : "GAMMA", "Summary" : "Subordinate host command test (if applicable)" }, "epp-26" : { "Description" : "This test case verifies that clients cannot create internal host objects\nwith glue that are subordinate to a domain object sponsored by another\nclient.\n\nMost EPP servers restrict creation of internal hosts to the sponsor of the\nsuperordinate domain object. However, some servers allow clients to create\na subordinate host object under any domain name.\n\nWhere the server implements a \"wide glue\" policy, this poses a security\nrisk, in that a malicious client could create an internal host that (a) is\nsubordinate to a victim domain and (b) has glue records which would then be\npublished in the DNS. This risk can be mitigated by forbidding the inclusion\nof `` records in the `` commands for such internal hosts (the\nsponsoring client of the resultant host object, which must be the sponsor\nof the superordinate domain object, must then use an `` to add\nglue to the object before it can be used).\n\nThe test client will connect to the EPP server, authenticate, and then\ncreate a domain name delegated to randomly-generated external host objects.\n\nIt will then reconnect using an alternate set of credentials, and attempt to\ncreate a host object that is subordinate to the previously created domain\nname. The `` command will include at least one IPv4 address.\n\nThe server **MUST** reject the command.\n\nThis test case will be skipped if (a) the value of the `dns.gluePolicy`\ninput parameter is `narrow`, or (b) if the value of the `epp.hostModel`\ninput parameter is `attributes`.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_INVALID_EXTENSION", "EPP_SERVER_ACCEPTS_INTERNAL_HOST_WITH_GLUE" ], "Input-Parameters" : [ "dns.gluePolicy" ], "Summary" : "Wide glue host object access control (if applicable)" }, "epp-27" : { "Description" : "Some EPP servers allow clients to create a subordinate host object under any\ndomain name, with the proviso that glue must not be specified in the\n`` command.\n\nThis test case verifies that EPP servers do not allow domain objects to be\ndelegated to glueless internal host objects.\n\nThis test case will be skipped if the value of the `epp.hostModel` input\nparameter is `attributes`.\n\nThe test client will connect to the EPP server, authenticate, and then\ncreate a domain name delegated to randomly-generated external host objects.\n\nIt will then reconnect using an alternate set of credentials, and attempt to\ncreate a internal host object that is subordinate to the previously created\ndomain name. The `` command will not include any `` elements.\n\nIf the server rejects the command, the test passes at that point.\n\nHowever, if the server accepts the command, the test client will re-connect\nusing the original set of credentials, and use an `` command to\nattempt to add the previously created internal host object to the domain\nobject created in the first step.\n\nThe server **MUST** reject the command.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_INVALID_EXTENSION", "EPP_SERVER_ALLOWS_DELEGATION_TO_GLUELESS_HOST" ], "Summary" : "Glueless internal host object access control (if applicable)" }, "idn-01" : { "Description" : "This test case validates that the EPP server correctly validates IDN domains\nduring the EPP `` process and applies the applicable rules in\nrelation to handling of variants.\n\nUsing the TLD(s) to which the test relates, and the sets of allocatable and\nunallocatable test labels associated with the IDN tables specified for those\nTLDs, a set of valid and invalid domain names will be generated.\n\nThe test client will then connect to the EPP server, and perform ``\ncommands for each domain, checking to confirm that the EPP server correctly\naccepts or rejects the command, as applicable.\n\nWhere a variant policy is applicable (which is determined by both the IDN\ntable and the policy specified for the TLD), and variant domains are\ngenerated, The client will also ensure that the EPP server properly\nimplements that policy: that is, variant domains must (a) be blocked, or (b)\nonly be available for registration by (i) the same registrant, or (ii) if\nthe TLD uses the minimal public data set, the same registrar.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_LOGIN_ERROR", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_INVALID_IDN_EXTENSION", "IDN_SERVER_ACCEPTS_INVALID_LABEL", "IDN_SERVER_REJECTS_VALID_LABEL", "IDN_VARIANT_LABEL_NOT_BLOCKED", "IDN_VARIANT_SERVER_ACCEPTS_VARIANT_CREATE_FROM_INCORRECT_REGISTRAR", "IDN_VARIANT_SERVER_ACCEPTS_VARIANT_CREATE_WITH_INCORRECT_REGISTRANT", "IDN_VARIANT_SERVER_REJECTS_VARIANT_CREATE_FROM_SAME_REGISTRAR", "IDN_VARIANT_SERVER_REJECTS_VARIANT_CREATE_WITH_SAME_REGISTRANT", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "idn.domainCreateExtension" ], "Maturity" : "BETA", "Summary" : "IDN label validation test" }, "idn-02" : { "Description" : "This test confirms that the EPP server rejects EPP `` commands for\na domain under TLDs that are configured to be \"IDN only\" (that is, pure\nASCII domains are not permitted).\n\nIf all TLDs in the test have `idnOnly` properties that are `false`, this\ntest will be skipped.\n\nFor those TLDs for which the `idnOnly` property is `true`, an EPP ``\ncommand will be sent to the EPP server for a domain name that is\nsyntactically valid, comprised only of characters from the LDH ASCII range,\nand not already registered.\n\nThe EPP server **MUST** reject the command.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "IDN_IDNONLY_TLD_ACCEPTS_ASCII_DOMAIN", "EPP_INVALID_EXTENSION" ], "Maturity" : "BETA", "Summary" : "ASCII domains in IDN-only TLD test" }, "integration-01" : { "Description" : "This test confirms that the EPP and RDAP systems are properly integrated,\nthat is, that transform commands performed on objects in the EPP system\nare reflected in the RDAP system within the Service Level Requirement of\nthe SLA.\n\nThe test system will connect to the EPP server and create domain and (if\napplicable) host and contact objects using the same methodology as `epp-14`\nand `epp-11`. It will then perform RDAP queries for those objects.\n\nThe RDAP server **MUST** provide a 200 response for every object created\nwithin 1 hour of the object's `` element.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_LOGIN_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_SCHEMA_VALIDATION_ERROR", "INTEGRATION_RDAP_REQUEST_FAILED", "INTEGRATION_DOMAIN_NOT_PRESENT_IN_RDAP", "EPP_INVALID_EXTENSION" ], "Implemented" : "1", "Input-Parameters" : [ "rdap.baseURLs" ], "Maturity" : "GAMMA", "Summary" : "EPP -> RDAP Integration Test" }, "integration-02" : { "Description" : "This test confirms that the EPP and DNS systems are properly integrated,\nthat is, that transform commands performed on objects in the EPP system\nare reflected in the DNS within the Service Level Requirement of the SLA.\n\nThe test system will connect to the EPP server and create domain and (if\napplicable) host and contact objects using the same methodology as\n`integration-01`.\n\nThe test system will perform DNS queries to confirm that the DNS servers\nprovide responses for the created domain names. All DNS servers **MUST**\nprovide the correct DNS response for all domains within 1 hour of the\ndomain's `` element.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_LOGIN_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_SCHEMA_VALIDATION_ERROR", "INTEGRATION_DNS_QUERY_FAILED", "INTEGRATION_DOMAIN_NOT_PRESENT_IN_DNS", "EPP_INVALID_EXTENSION" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "EPP -> DNS Integration Test" }, "integration-03" : { "Description" : "This test confirms that the EPP and RDE systems are properly integrated,\nthat is, that objects created in the EPP system are reflected in a valid\nRDE deposit file within the Service Level Requirement of the SLA.\n\nThe test system will connect to the EPP server and create domain and (if\napplicable) host and contact objects using the same methodology as\n`integration-01`.\n\nThe test system will periodically connect to the SFTP server specified by\nthe `integration.rdeSFTPHostname` input parameter, using the username\nspecified in the `integration.rdeSFTPUsername` input parameter and the SSH\nkey in the `integration.rdeSFTPPublicKey` resource, and look for .ryde\nfiles in the directory specified by the `integration.rdeSFTPDirectory`\ninput parameter. Note that operators **MUST** ensure that the IP addresses\nlisted in the `integration.rdeSFTPACL` resource have been added to the\nAccess Control List for the SFTP server (if any).\n\nAll objects created **MUST** be found in a RDE deposit file within 24 hours\nof each object's `` element.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_LOGIN_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_SCHEMA_VALIDATION_ERROR", "INTEGRATION_RDE_SFTP_SERVER_UNREACHABLE", "INTEGRATION_RDE_SFTP_SERVER_AUTHENTICATION_ERROR", "INTEGRATION_DOMAIN_NOT_PRESENT_IN_RDE", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "integration.rdeSFTPHostname", "integration.rdeSFTPDirectory", "integration.rdeSFTPUsername" ], "Maturity" : "GAMMA", "Resources" : [ "integration.rdeSFTPPublicKey", "integration.rdeSFTPACL" ], "Summary" : "EPP -> RDE Integration Test" }, "integration-04" : { "Description" : "This test case verifies that the registry system correctly implements the\nspecified glue policy, for EPP servers that use host objects.\n\nThis test case will be skipped unless the value of the `dns.gluePolicy`\ninput parameter is `narrow` and the value of the `epp.hostModel` input\nparameter is `objects`.\n\nThe test client will connect to the EPP server, authenticate, and then\ncreate a domain name.\n\nIt will then create three internal host objects that are subordinate to the\npreviously created domain name, each with different IP addresses.\n\nThe client will then submit an `` command to assign two of the three\nhost objects to the domain, but not the third.\n\nThen, the DNS servers specified in the `dns.nameservers` will be monitored\nby sending periodic A/AAAA DNS queries for host names previously described.\n\nWithin 60 minutes of the completion of the `` command described\nabove, the A/AAAA record(s) for the two host objects assigned to the domain\n**MUST** be observed in DNS query responses. The A/AAAA record(s) for the\nunlinked host object **MUST NOT** be observed in DNS query responses\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_LOGIN_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_INVALID_EXTENSION", "INTEGRATION_LINKED_HOST_OBJECTS_NOT_OBSERVED", "INTEGRATION_UNLINKED_HOST_OBJECTS_OBSERVED" ], "Summary" : "Glue policy verification (host objects)" }, "integration-05" : { "Description" : "This test case verifies that the registry system correctly implements the\nspecified glue policy, for EPP servers that use host attributes.\n\nThis test case will be skipped unless the value of the `dns.gluePolicy`\ninput parameter is `narrow` and the value of the `epp.hostModel` input\nparameter is `attributes`.\n\nThe test client will connect to the EPP server, authenticate, and then\ncreate a domain name. The `` command will include ``\nelements for two names that are subordinate to the domain being created.\nEach `` element will contain at least one `` element.\n\nIt will then reconnect using an alternate set of credentials, and attempt to\ncreate another domain name. The `` command will include ``\nelements for two names that are also subordinate to the previously created\ndomain, with different names, and different IP addresses in the ``\nelement(s).\n\nThen, the DNS servers specified in the `dns.nameservers` will be monitored\nby sending periodic A/AAAA DNS queries for host names assigned to the two\ndomain names.\n\nWithin 60 minutes of the completion of the `` command for that\ndomain, the A/AAAA record(s) for the nameservers assigned to the first\ndomain **MUST** be observed in DNS query responses. The A/AAAA record(s) for\nthe nameservers assigned to the second domain **MUST NOT** be observed in\nDNS query responses.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_LOGIN_ERROR", "EPP_XML_PARSE_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_UNEXPECTED_COMMAND_FAILURE", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_INVALID_EXTENSION", "INTEGRATION_EXPECTED_GLUE_NOT_OBSERVED", "INTEGRATION_UNEXPECTED_GLUE_OBSERVED" ], "Summary" : "Glue policy verification (host attributes)" }, "minimumRPMs-01" : { "Description" : "This test is used to confirm the conformance of the EPP server's\nimplementation of the Claims Check Form, as described in Section\n3.1.1 of RFC 8334.\n\nFor this test, the applicant must configure their system using the test\nTMCH data files found in the following resources:\n\n* `tmch.testCert`\n* `tmch.testCRL`\n* `tmch.testDNL`\n* `tmch.testSMDRL`\n* `tmch.testSURL`\n\nThe client will connect to the EPP server using the provided credentials\nand will then perform a series of `` commands, using the Launch\nextension to specify a value of `claims` for the `type` attribute of the\n`` element and the `` element. It will then\nconfirm that the server returns an appropriate response:\n\n* a `` response for a domain that is present on the DNL contains\n the correct `` element;\n* a `` response for a domain that is NOT present on the DNL\n does not contain a `` element.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "RPMS_MISSING_CLAIMS_KEY", "RPMS_UNEXPECTED_CLAIMS_KEY", "RPMS_INVALID_CLAIMS_KEY", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Claims command test" }, "minimumRPMs-02" : { "Description" : "This test is used to confirm the conformance of the EPP server's\nimplementation of the Sunrise Create Form, as described in Section\n3.3.1 of RFC 8334.\n\nFor this test, the applicant must configure their system using the test\nTMCH data files found in the following resources:\n\n* `tmch.testCert`\n* `tmch.testCRL`\n* `tmch.testDNL`\n* `tmch.testSMDRL`\n* `tmch.testSURL`\n\nThe client will connect to the EPP server and will submit ``\ncommands, using domain names and SMD files present in the TMCH test\nenvironment.\n\nIf the server supports Start Date sunrises, the fully-qualified domain\nname will be constructed using a label from the SMD file and the\n`minimumRPMS.sunriseTLD` input parameter. If the domain is not already\npresent in the registry, the Server **MUST** respond with a `1000` or `1001`\nresult code, however, if the client receives a `2302` \"object exists\" result\ncode, it will retry with a different domain name, until a `1000` or `1001`\nresponse is received.\n\nIf the server supports End Date sunrises, the fully-qualified domain\nname will be constructed using a label from the SMD file and the\n`minimumRPMS.sunriseTLD` input parameter. The Server **MUST** respond with\na `1000` or `1001` result code, and create a launch application.\n\nOnce the `` commands have been processed, the client will then\nperform `` commands to confirm that the domains or launch applications\nhave been created and that the submitted object properties have been\ncorrectly stored.\n\nThe client will also confirm that the server rejects attempts to:\n\n1. create a domain using an invalid SMD;\n2. create a domain using a revoked SMD;\n3. create a domain using an SMD signed by a revoked certificate.\n4. create a domain using an SMD for a different domain.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_SMD", "RPMS_SUNRISE_CREATE_UNEXPECTED_FAILURE_USING_VALID_SMD", "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_REVOKED_SMD", "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_SMD_WITH_REVOKED_SIGNATURE", "RPMS_SUNRISE_CREATE_UNEXPECTED_SUCCESS_USING_INCORRECT_SMD", "RPMS_SUNRISE_CREATE_INFO_OBJECT_DOES_NOT_EXIST", "RPMS_SUNRISE_CREATE_INFO_OBJECT_IS_HAS_MISSING_OR_INVALID_PROPERTIES", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Sunrise domain/launch application command test\n" }, "minimumRPMs-03" : { "Description" : "This test is used to confirm the conformance of the EPP server's\nimplementation of the Claims Create Form, as described in Section\n3.3.2 of RFC 8334.\n\nFor this test, the applicant must configure their system using the test\nTMCH data files found in the following resources:\n\n* `tmch.testCert`\n* `tmch.testCRL`\n* `tmch.testDNL`\n* `tmch.testSMDRL`\n* `tmch.testSURL`\n\nThe client will connect to the EPP server and will submit ``\ncommands, using domain names present in the TMCH test environment.\n\nThe domain name will be constructed using a label from the DNL, and the\n`minimumRPMS.claimsTLD` input parameter. The client will perform a\nTrademark Claims `` command beforehand to obtain the claim key, and\nwill then synthesise a trademark claims acknowledgement. The server\n**MUST** respond with a `1000` or `1001` response.\n\nOnce the `` commands have been processed, the client will then\nperform `` commands to confirm that the domains have been created and\nthat the submitted object properties have been correctly stored.\n\nThe client will also confirm that the server rejects attempts to:\n\n1. create a domain using an invalid notice ID (invalid checksum);\n2. create a domain using an expired notice ID;\n3. create a domain using an acceptance datetime more than 12 months in the\n past.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "RPMS_MISSING_CLAIMS_KEY", "RPMS_TRADEMARK_CREATE_UNEXPECTED_FAILURE_USING_VALID_NOTICE_ID", "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_NOTICE_ID", "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_EXPIRED_NOTICE_ID", "RPMS_TRADEMARK_CREATE_UNEXPECTED_SUCCESS_USING_INVALID_ACCEPTANCE_DATE", "RPMS_TRADEMARK_CREATE_INFO_OBJECT_DOES_NOT_EXIST", "RPMS_TRADEMARK_CREATE_INFO_OBJECT_IS_HAS_MISSING_OR_INVALID_PROPERTIES", "EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Trademark claims domain command test" }, "rdap-01" : { "Description" : "This test validates the server's response to a domain name query.\n\nThe client will send domain query requests for each domain name in the\n`rdap.testDomains` input parameter and validate the responses for\nconformance with the gTLD RDAP Profile.\n\nIf the value of the `general.registryDataModel` is `minimum`, then the\nresponse will be validated against the \"thin\" validation rules, whereas the\n\"thick\" rules will be used if the value of the parameter is `maximum`. If\nthe value is `per-registrar`, then the response **MUST** correctly validate\nagainst one of the two rulesets.\n\nIf any of the responses cannot be validated, then this test case will fail.\n", "Errors" : [ "RDAP_DOMAIN_RESPONSE_VALIDATION_FAILED" ], "Implemented" : "1", "Input-Parameters" : [ "general.registryDataModel" ], "Maturity" : "BETA", "Summary" : "Domain query test" }, "rdap-02" : { "Description" : "This test validates the server's response to a nameserver name query.\nIf the value of the `epp.hostModel` input parameter is `attributes`, this test will be skipped.\nThe client will send nameserver query requests for each nameserver in the `rdap.testNameservers` input parameter and validate the responses for conformance with the gTLD RDAP Profile.\nIf any of the responses cannot be validated, then this test case will fail.", "Errors" : [ "RDAP_NAMESERVER_RESPONSE_VALIDATION_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Nameserver query test" }, "rdap-03" : { "Description" : "This test validates the server's response to an entity query for a\nregistrar.\n\nThe client will send entity query requests for each entity in the\n`rdap.testEntities` input parameter and validate the responses for\nconformance with the gTLD RDAP Profile.\n\nIf any of the responses cannot be validated, then this test case will fail.\n", "Errors" : [ "RDAP_ENTITY_RESPONSE_VALIDATION_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Registrar query test" }, "rdap-04" : { "Description" : "This test validates the server's response to a help query.\n\nThe client will send a help query to each base URL specified in the\n`rdap.baseURLs` input parameter, and validate the responses for\nconformance with the gTLD RDAP Profile.\n\nIf any of the responses cannot be validated, then this test case will fail.\n", "Errors" : [ "RDAP_HELP_RESPONSE_VALIDATION_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Help query test" }, "rdap-05" : { "Description" : "This test validates that the server supports `HEAD` requests for domain\nnames.\n\nThe client will issue a `HEAD` request for each domain name in the\n`rdap.testDomains` input parameter and confirm that the server sends a\nresponse with (a) a status code of `200`, (b) a valid\n`access-control-allow-origin` header field, and (c) an empty body.\n", "Errors" : [ "RDAP_DOMAIN_HEAD_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Domain HEAD test" }, "rdap-06" : { "Description" : "This test validates that the server supports `HEAD` requests for\nnameservers.\n\nIf the value of the `epp.hostModel` input parameter is `attributes`, this\ntest will be skipped.\n\nThe client will issue a `HEAD` request for each nameserver in the\n`rdap.testNameservers` input parameter and confirm that the server sends a\nresponse with (a) a status code of `200`, (b) a valid\n`access-control-allow-origin` header field, and (c) an empty body.\n", "Errors" : [ "RDAP_NAMESERVER_HEAD_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Nameserver HEAD test" }, "rdap-07" : { "Description" : "This test validates that the server supports `HEAD` requests for entities.\n\nThe client will issue a `HEAD` request for each entity in the\n`rdap.testEntities` input parameter and confirm that the server sends a\nresponse with (a) a status code of `200`, (b) a valid\n`access-control-allow-origin` header field, and (c) an empty body.\n", "Errors" : [ "RDAP_ENTITY_HEAD_FAILED" ], "Implemented" : "1", "Maturity" : "BETA", "Summary" : "Entity HEAD test" }, "rdap-08" : { "Description" : "This test validates that the server correctly responds to queries for\nnon-existent domain names.\n\nThe client will issue a `GET` request for a randomly-generated domain name.\nThe server **MUST** respond with a 404 HTTP response code. If present, the\nbody of the response **MUST** be a valid RDAP error object. The\n`access-control-allow-origin` header field **MUST** also be present.\n", "Errors" : [ "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_DOMAIN" ], "Summary" : "Non-existent domain test" }, "rdap-09" : { "Description" : "This test validates that the server correctly responds to queries for\nnon-existent nameservers.\n\nThe client will issue `GET` requests for two randomly-generated host names,\none internal and one external, for each TLD.\n\nIn both cases, the server **MUST** respond with a 404 HTTP response code.\nIf present, the body of the response **MUST** be a valid RDAP error object.\nThe `access-control-allow-origin` header field **MUST** also be present.\n", "Errors" : [ "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_NAMESERVER" ], "Summary" : "Non-existent nameserver test" }, "rdap-10" : { "Description" : "This test validates that the server correctly responds to queries for\nnon-existent entities.\n\nThe client will issue a `GET` request for a randomly-generated entity\nhandle. The server **MUST** respond with a 404 HTTP response code. If\npresent, the body of the response **MUST** be a valid RDAP error object. The\n`access-control-allow-origin` header field **MUST** also be present.\n", "Errors" : [ "RDAP_INVALID_RESPONSE_FOR_NON_EXISTENT_ENTITY" ], "Summary" : "Non-existent entity test" }, "rdap-91" : { "Description" : "This test case verifies that the RDAP server properly implements a secure\nTLS configuration.\n\n1. All service ports **MUST** support TLSv1.2 and optionally any subsequent\n protocol published by the IETF.\n2. TLSv1.1 and all previous versions have known security issues and **MUST\n NOT** be supported by any service ports.\n3. To ensure that the connection can be trusted, all service ports\n **MUST** present a certificate issued by a trusted CA, such as those\n supported by major browsers (see the `epp.tlsCertificateStore` resource).\n4. All TLS certificates **MUST NOT** have expired, and **MUST** be\n presented wth any required intermediate certificates.\n5. The RDAP server name **MUST** match at least one `subjectAltName` field\n in all presented certificates (either exact match or wildcard).\n6. Service ports **MUST** use at least one of the ciphers recommended in\n [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325.html) (or any successor\n document).\n", "Errors" : [ "RDAP_TLS_DNS_RESOLUTION_ERROR", "RDAP_TLS_SERVICE_PORT_UNREACHABLE", "RDAP_TLS_NO_SERVICE_PORTS_REACHABLE", "RDAP_TLS_REQUIRED_PROTOCOL_NOT_SUPPORTED", "RDAP_TLS_FORBIDDEN_PROTOCOL_SUPPORTED", "RDAP_TLS_UNTRUSTED_CERTIFICATE", "RDAP_TLS_EXPIRED_CERTIFICATE", "RDAP_TLS_CERTIFICATE_CHAIN_MISSING", "RDAP_TLS_CERTIFICATE_HOSTNAME_MISMATCH", "RDAP_TLS_BAD_CIPHER" ], "Implemented" : "1", "Maturity" : "GAMMA", "Resources" : [ "epp.tlsCertificateStore" ], "Summary" : "TLS version conformance check" }, "rdap-92" : { "Description" : "This test confirms that all RDAP service ports return identical responses.\n\nSince applicants must provide an RDAP service over both IPv4 and IPv6, at\nleast two service ports will be checked.\n\nThe client will establish separate connections to each RDAP service port\n(defined as an IP address and TCP port, where at least one IPv4 address/port\npair and IPv6 address/port pair are expected) and perform RDAP queries on\nthe objects specified in the `rdap.testDomains`, `rdap.testEntities`, and\n`rdap.testNameservers` input parameters.\n\nThe responses returned by each service port (1) **MUST** have the 200 status\ncode, and (2) **MUST**, with the exception of the `last update of RDAP\ndatabase` event, be consistent, once the JSON body has been parsed and\ncanonicalised. The values that appear in the `entities`, `events`,\n`notices`, `remarks`, `links`, `rdapConformance`, `publicIDs`, `status`,\n`ipAddresses`, `nameservers` and `redactions` properties of the response may\n(if present) appear in any order.\n", "Errors" : [ "RDAP_TLS_DNS_RESOLUTION_ERROR", "RDAP_TLS_SERVICE_PORT_UNREACHABLE", "RDAP_TLS_NO_SERVICE_PORTS_REACHABLE", "RDAP_QUERY_FAILED", "RDAP_SERVICE_PORT_NOT_CONSISTENT" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Service port consistency check" }, "rde-01" : { "Description" : "* The deposit filename **MUST** conform to the format specified in the RA.\n* The type of the deposit **MUST** be `FULL`.\n* The TLD in the filename **MUST** be present in the list of TLDs\n associated with the test.\n", "Errors" : [ "RDE_INVALID_FILENAME" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate deposit filename format" }, "rde-02" : { "Description" : "The PGP signature **MUST** be valid for the deposit file and the RSP's\nkey.\n", "Errors" : [ "RDE_INVALID_SIGNATURE" ], "Implemented" : "1", "Input-Parameters" : [ "rde.publicKey", "rde.signatureFile" ], "Maturity" : "GAMMA", "Summary" : "Validate signature over deposit file" }, "rde-03" : { "Description" : "It **MUST** be possible to decrypt the deposit file using the RST key. The\nPGP public key for which the deposit **MUST** be encrypted may be found in\nthe URL specified by the `rde.encryptionKey` resource.\n", "Errors" : [ "RDE_DECRYPTION_FAILED" ], "Implemented" : "1", "Maturity" : "GAMMA", "Resources" : [ "rde.encryptionKey" ], "Summary" : "Decrypt deposit file(s)" }, "rde-04" : { "Description" : "* XML deposit files **MUST** be well-formed and validate against the XML\n schema.\n* CSV files (if present) **MUST** conform to RFC 4180.\n* Deposits **MAY** contain a mix of both models, but an object **MUST** be\n escrowed only in one model.\n", "Errors" : [ "RDE_MISSING_FILES", "RDE_XML_PARSE_ERROR", "RDE_SCHEMA_VALIDATION_ERROR", "RDE_INVALID_CSV", "RDE_OBJECT_HAS_MIXED_TYPES" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate XML/CSV" }, "rde-05" : { "Description" : "The `` and `` objects **MUST** reference the\ncorrect object XML namespace URIs.\n\nThe correct URIs are determined by the test configuration and the input\nparameters. At minimum, the list of URIs **MUST** include `rdeDomain` and\n`rdeRegistrar` (if using XML) or `csvDomain` and `csvRegistrar` (if using\nCSV) URIs.\n\n* If the `general.registryDataModel` input parameter is `maximum` or\n `per-registrar`, then either the `rdeContact` or `csvContact` URI **MUST**\n be present, as applicable for the deposit type. If the input parameter is\n `minimum`, then it **MUST NOT** be present.\n\n* If the `epp.hostModel` input parameter is `objects`, then either the\n `rdeHost` or `csvHost` URI **MUST** be present, as applicable for the\n deposit type. If the input parameter is `attributes`, then it **MUST NOT**\n be present.\n\n* If the TLD to which the deposit relates is associated with one or more IDN\n tables, then either the `rdeIDN` or `csvIDN` URI **MUST** be present, as\n applicable for the deposit type.\n\nAll expected URIs **MUST** be present, and unexpected URIs **MUST NOT** be\npresent.\n\nThe set of URIs in the `` elements in the `` element\n**MUST** match the set of URIs in the `uri` attributes of the ``\nelements in the `` element.\n\n| **Namespace URI** | **Deposit type** | **Notes** |\n| :---------------------------------------- | :------------: | :-------- |\n| `urn:ietf:params:xml:ns:csvContact-1.0` | CSV | Must be present and count > 0 if `general.registryDataModel` != 'minimum'\n| `urn:ietf:params:xml:ns:csvDomain-1.0` | CSV | Must be present and count > 0\n| `urn:ietf:params:xml:ns:csvHost-1.0` | CSV | Must be present and count > 0 if `epp.hostModel` = 'objects'\n| `urn:ietf:params:xml:ns:csvIDN-1.0` | CSV | Must be present and count > 0 if TLD has IDN tables\n| `urn:ietf:params:xml:ns:csvNNDN-1.0` | CSV | May be present\n| `urn:ietf:params:xml:ns:csvRegistrar-1.0` | CSV | Must be present and count > 0\n| `urn:ietf:params:xml:ns:rdeContact-1.0` | XML | Must be present and count > 0 if `general.registryDataModel` != 'minimum'\n| `urn:ietf:params:xml:ns:rdeDomain-1.0` | XML | Must be present and count > 0\n| `urn:ietf:params:xml:ns:rdeEppParams-1.0` | XML | Must be present and count > 0\n| `urn:ietf:params:xml:ns:rdeHost-1.0` | XML | Must be present and count > 0 if `epp.hostModel` = 'objects'\n| `urn:ietf:params:xml:ns:rdeIDN-1.0` | XML | Must be present and count > 0 if TLD has IDN tables\n| `urn:ietf:params:xml:ns:rdeNNDN-1.0` | XML | May be present\n| `urn:ietf:params:xml:ns:rdeRegistrar-1.0` | XML | Must be present and count > 0\n", "Errors" : [ "RDE_UNEXPECTED_OBJECT_URI", "RDE_MISSING_OBJECT_URI", "RDE_MENU_AND_HEADER_URIS_DIFFER" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate object types" }, "rde-06" : { "Description" : "The number of each type of object specified by the `` elements in the\n` element **MUST** match the number of objects actually present in\nthe deposit file.\n", "Errors" : [ "RDE_OBJECT_COUNT_MISMATCH", "RDE_UNEXPECTED_OBJECT" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate object counts" }, "rde-07" : { "Description" : "Domain objects (whether CSV or XML) **MUST** have the required object\nproperties, and the values of those object properties **MUST** be\nwell-formed.\n\nAt least one domain object **MUST** be present in the deposit.\n\nThe required properties are:\n\n* `` (which **MUST** be unique and be subordinate for the TLD\n to which the deposit relates)\n* `` (which **MUST** comply with the specification in [Section\n 2.8 of RFC 5730](https://www.rfc-editor.org/rfc/rfc5730#section-2.8)\n and contain a repository ID that is registered in the [EPP Repository\n Identifiers\n Registry](https://www.iana.org/assignments/epp-repository-ids/epp-repository-ids.xhtml)).\n* at least one `` element\n* `` (if `general.registryDataModel` is `maximum`)\n* `` (sponsoring registrar ID)\n* `` (creation date), which **MUST** be before the timestamp\n in the deposit's '`` element.\n* `` (expiry date), which **MUST** be after the timestamp\n in the deposit's '`` element, unless the domain has the\n `pendingDelete` status.\n\nContact, host and registrar objects (including optional objects such as\nadmin and tech contacts) which are referenced in domain objects **MUST**\nbe present in the deposit.\n\nIf the domain has an `` element, its value **MUST** match the\n`id` property of one of the IDN table objects in the deposit.\n", "Errors" : [ "RDE_DOMAIN_HAS_INVALID_NAME", "RDE_DOMAIN_HAS_NON_UNIQUE_NAME", "RDE_DOMAIN_HAS_MISSING_ROID", "RDE_DOMAIN_HAS_INVALID_ROID", "RDE_DOMAIN_HAS_NON_UNIQUE_ROID", "RDE_DOMAIN_HAS_MISSING_STATUS", "RDE_DOMAIN_HAS_INVALID_STATUS", "RDE_DOMAIN_HAS_MISSING_REGISTRANT", "RDE_DOMAIN_HAS_INVALID_REGISTRANT", "RDE_DOMAIN_HAS_MISSING_CONTACT", "RDE_DOMAIN_HAS_MISSING_NAMESERVER", "RDE_DOMAIN_HAS_MISSING_CLID", "RDE_DOMAIN_HAS_INVALID_CLID", "RDE_DOMAIN_HAS_MISSING_CRDATE", "RDE_DOMAIN_HAS_INVALID_CRDATE", "RDE_DOMAIN_HAS_MISSING_EXDATE", "RDE_DOMAIN_HAS_INVALID_EXDATE", "RDE_DOMAIN_OBJECT_MISSING", "RDE_DOMAIN_HAS_INVALID_CRRR", "RDE_DOMAIN_HAS_INVALID_UPRR", "RDE_DOMAIN_HAS_INVALID_RERR", "RDE_DOMAIN_HAS_INVALID_ACRR", "RDE_DOMAIN_HAS_UNEXPECTED_HOST_OBJECTS", "RDE_DOMAIN_HAS_UNEXPECTED_HOST_ATTRIBUTES" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate domain objects" }, "rde-08" : { "Description" : "Host objects (whether CSV or XML) **MUST** have the required object\nproperties, and the values of those object properties **MUST** be\nwell-formed.\n\nThe required properties are:\n\n* `` (which **MUST** be unique)\n* `` (which **MUST** be unique and **MUST** comply with the specification in [Section\n 2.8 of RFC 5730](https://www.rfc-editor.org/rfc/rfc5730#section-2.8)\n and contain a repository ID that is registered in the [EPP Repository\n Identifiers\n Registry](https://www.iana.org/assignments/epp-repository-ids/epp-repository-ids.xhtml)).\n* at least one `` element\n* one or more `` elements (if the host name is subordinate to\n the TLD)\n* `` (sponsoring registrar ID)\n\nIf the applicant uses the host attribute model, then this test will be\nskipped.\n\nRegistrar objects which are referenced in host objects **MUST**\nbe present in the deposit.\n", "Errors" : [ "RDE_HOST_HAS_INVALID_NAME", "RDE_HOST_HAS_NON_UNIQUE_NAME", "RDE_HOST_HAS_MISSING_ROID", "RDE_HOST_HAS_INVALID_ROID", "RDE_HOST_HAS_NON_UNIQUE_ROID", "RDE_HOST_HAS_MISSING_STATUS", "RDE_HOST_HAS_INVALID_STATUS", "RDE_HOST_HAS_MISSING_IP_ADDRESS", "RDE_HOST_HAS_INVALID_IP_ADDRESS", "RDE_HOST_HAS_MISSING_CLID", "RDE_HOST_HAS_INVALID_CLID", "RDE_HOST_OBJECT_MISSING" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate host objects (if applicable)" }, "rde-09" : { "Description" : "Contact objects (whether CSV or XML) **MUST** have the required object\nproperties, and the values of those object properties **MUST** be\nwell-formed.\n\nIf the value of the `general.registryDataModel` input parameter is\n`minimum`, then this test will be skipped.\n\n* The value of the `` element **MUST** be unique in the deposit;\n* The value of the `` (which **MUST** be unique and **MUST** comply with the\n specification in [Section 2.8 of RFC 5730](https://www.rfc-editor.org/rfc/rfc5730#section-2.8)\n and contain a repository ID that is registered in the [EPP Repository\n Identifiers\n Registry](https://www.iana.org/assignments/epp-repository-ids/epp-repository-ids.xhtml));\n* The object **MUST NOT** have two `` elements with\n the same `type` attribute;\n* The value of the `` element **MUST** contain a valid\n [ISO-3166-alpha-2 country\n code](https://www.iso.org/iso-3166-country-codes.html);\n* The value of the `` element **MUST** be a valid email\n address, as described in [Section 3.4.1 of RFC\n 5322](https://www.rfc-editor.org/rfc/rfc5322.html#section-3.4.1).\n\nRegistrar objects which are referenced in contact objects **MUST** be\npresent in the deposit.\n", "Errors" : [ "RDE_CONTACT_HAS_NON_UNIQUE_ID", "RDE_CONTACT_HAS_INVALID_ROID", "RDE_CONTACT_HAS_NON_UNIQUE_ROID", "RDE_CONTACT_HAS_MULTIPLE_POSTALINFO_TYPES", "RDE_CONTACT_HAS_INVALID_CC", "RDE_CONTACT_HAS_INVALID_EMAIL", "RDE_CONTACT_HAS_UNKNOWN_CLID", "RDE_CONTACT_HAS_UNKNOWN_CRRR", "RDE_CONTACT_HAS_UNKNOWN_UPRR", "RDE_CONTACT_HAS_UNKNOWN_RERR", "RDE_CONTACT_HAS_UNKNOWN_ACRR", "RDE_CONTACT_OBJECT_MISSING" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate contact objects (if applicable)" }, "rde-10" : { "Description" : "Registrar objects (whether CSV or XML) **MUST** have the required object\nproperties, and the values of those object properties **MUST** be\nwell-formed.\n\nAt least one registrar object **MUST** be present in the deposit.\n\nThe required properties are:\n\n* `` which **MUST** be unique;\n* ``;\n* `` which **MUST** be a valid [Registrar\n ID](https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml).\n", "Errors" : [ "RDE_REGISTRAR_HAS_NON_UNIQUE_ID", "RDE_REGISTRAR_HAS_MISSING_ID", "RDE_REGISTRAR_HAS_INVALID_ID", "RDE_REGISTRAR_HAS_MISSING_NAME", "RDE_REGISTRAR_HAS_INVALID_NAME", "RDE_REGISTRAR_HAS_MISSING_GURID", "RDE_REGISTRAR_HAS_INVALID_GURID", "RDE_REGISTRAR_OBJECT_MISSING" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate registrar objects" }, "rde-11" : { "Description" : "IDN table objects (whether CSV or XML) **MUST** have the required object\nproperties, and the values of those object properties **MUST** be\nwell-formed.\n\n* The value of the `id` attribute of all IDN table objects present in the\n deposit **MUST** correspond to the language tag of all IDN tables\n specified for the TLD in the test request, all such tables **MUST** have a\n corresponding object in the deposit.\n* The `` element **MUST** (if present) contain a valid URL.\n* The `` element **MUST** (if present) contain a valid URL.\n", "Errors" : [ "RDE_IDN_OBJECT_INVALID", "RDE_IDN_OBJECT_MISSING", "RDE_IDN_OBJECT_UNEXPECTED" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Validate IDN table objects (if applicable)" }, "rde-12" : { "Description" : "NNDN table objects (whether CSV or XML), if present, **MUST** have the\nrequired object properties, and the values of those object properties\n**MUST** be well-formed.\n\n* The value of the `` element **MUST NOT** match the value of the\n `` element of a domain object, or the `` element of another\n NNDN object.\n* The value of the `` **MUST** contain either `blocked`,\n `withheld` or `mirrored`.\n* If the NNDN has an `` element, its value **MUST** match the\n `id` property of one of the IDN table objects in the deposit.\n", "Errors" : [ "RDE_NNDN_HAS_NON_UNIQUE_NAME", "RDE_NNDN_CONFLICTS_WITH_DOMAIN" ], "Implemented" : "", "Maturity" : "GAMMA", "Summary" : "Validate NNDN objects (if applicable)" }, "rde-13" : { "Description" : "Exactly one EPP Parameters object **MUST** be present in the deposit and\n**MUST** pass the following checks:\n\n1. All `` element(s) **MUST** contain XML namespace URIs that are\n appropriate. The only mandatory URI that **MUST** be present is the\n domain namespace URI. The host and contact namespace URIs **MAY** be\n required, depending on the `epp.hostModel` and\n `general.registryDataModel` input parameters.\n2. The namespace URIs of all `` and `` element(s) **MUST**\n correspond to entries in the EPP Extension Registry.\n3. `` elements containing the following XML namespaces **MUST** be\n present:\n * `urn:ietf:params:xml:ns:secDNS-1.1`\n * `urn:ietf:params:xml:ns:rgp-1.0`\n", "Errors" : [ "RDE_MISSING_EPP_PARAMS_OBJECT", "RDE_MULTIPLE_EPP_PARAMS_OBJECTS", "RDE_EPP_PARAMS_UNEXPECTED_OBJURI", "RDE_EPP_PARAMS_MISSING_OBJURI", "RDE_EPP_PARAMS_UNEXPECTED_EXTURI", "RDE_EPP_PARAMS_MISSING_EXTURI" ], "Maturity" : "GAMMA", "Summary" : "Validate EPP parameters object" }, "rde-14" : { "Description" : "The object policies specified by the `` object(s) in the\ndeposit **MUST** conform to the Registration Data Policy and the applicable\ndata model.\n\n* If the `general.registryDataModel` input parameter is `maximum` or\n `per-registrar`, then a policy object that identifies the ``\n element of domain objects **MUST** be present.\n", "Errors" : [ "RDE_POLICY_OBJECT_MISSING", "RDE_POLICY_OBJECT_INVALID", "RDE_POLICY_OBJECT_MISSING_OBJECTS" ], "Maturity" : "GAMMA", "Summary" : "Validate policy object (if applicable)" }, "srsgw-01" : { "Description" : "This test confirms that the SRS Gateway EPP system is reachable over IPv4\nand IPv6.\n\nThe SRS Gateway EPP server host name will be resolved to obtain its\nIPv4 and IPv6 addresses. The client will then attempt to connect to TCP\nport 700 on these addresses and log in using the provided credentials.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_GENERIC_COMMAND_ERROR" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "IPv4 and IPv6 connectivity" }, "srsgw-02" : { "Description" : "This test confirms that host objects created in the SRS Gateway EPP system\nare correctly synchronized with the primary registry system.\n\nIf the value of the `epp.hostModel` input parameter is `attributes`, then\nthis test will be skipped.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated host name.\nIP address information will be provided if required. The server **MUST**\nrespond with a 1000 or 1001 response. The client will then perform an\n`` command and will capture the response.\n\nIt will then connect to the primary EPP system, authenticate, and perform\nan `` command for the object created in the first step. If the\nserver responds with a 2303 response, it will wait for 30 seconds and\nretry. The server **MUST** respond to the first or second `` command\nwith a 1000 response.\n\nThe two `` responses will then be compared and **MUST** be\nidentical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "EPP_GENERIC_COMMAND_ERROR", "SRSGW_HOST_CREATE_FAILED", "SRSGW_HOST_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE", "SRSGW_HOST_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Host synchronization (if applicable)" }, "srsgw-03" : { "Description" : "This test confirms that contact objects created in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nIf the `srsgw.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `srsgw.eppClid01DataModel`\nand `epp.eppClid02DataModel` input parameters.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated contact\nobject. The client will then perform an `` command and will capture\nthe response.\n\nIt will then connect to the primary EPP system, authenticate, and perform\nan `` command for the object created in the first step. If the\nserver responds with a 2303 response, it will wait for 30 seconds and\nretry. The server **MUST** respond to the first or second `` command\nwith a 1000 response.\n\nThe two `` responses will then be compared and **MUST** be identical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_CONTACT_CREATE_FAILED", "SRSGW_CONTACT_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE", "SRSGW_CONTACT_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Implemented" : "1", "Maturity" : "GAMMA", "Summary" : "Contact synchronization (if applicable)" }, "srsgw-04" : { "Description" : "This test confirms that domain objects created in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit `` commands for a pseudo-randomly generated domain names.\nContact and nameserver will be created if required. The server **MUST**\nrespond with 1000 or 1001 responses. The client will then perform ``\ncommands and will capture the responses.\n\nIt will then connect to the primary EPP system, authenticate, and perform\n`` commands for the domains created in the first step. If the\nserver responds with a 2303 response, it will wait for 30 seconds and\nretry. The server **MUST** respond to the first or second `` command\nwith a 1000 response.\n\nThe pairs of `` responses will then be compared and **MUST** be\nidentical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_DOMAIN_CREATE_FAILED", "SRSGW_DOMAIN_CREATE_OBJECT_NOT_FOUND_WITHIN_DEADLINE", "SRSGW_DOMAIN_CREATE_OBJECT_HAS_MISSING_OR_INVALID_PROPERTIES", "SRSGW_EPP_INVALID_EXTENSION", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "srsgw.domainCreateExtension" ], "Maturity" : "GAMMA", "Summary" : "Domain synchronization" }, "srsgw-05" : { "Description" : "This test confirms that the expiry dates of domain objects renewed in the\nSRS Gateway EPP system are correctly synchronized with the primary\nregistry system.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit `` commands for a pseudo-randomly generated domain name.\nContact and nameserver will be created if required. The server **MUST**\nrespond with a 1000 or 1001 response.\n\nIt will then submit a `` command. The server **MUST** respond with a\n1000 or 1001 response. The client will then perform `` commands and\nwill capture the responses.\n\nIt will wait for 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command for the domain renewed in the\nfirst step. The server **MUST** respond with a 1000 response.\n\nThe `` element of the two `` responses will then be compared\nand **MUST** be identical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_DOMAIN_RENEW_FAILED", "SRSGW_DOMAIN_RENEW_OBJECT_NOT_UPDATED_WITHIN_DEADLINE", "SRSGW_EPP_INVALID_EXTENSION", "SRSGW_DOMAIN_RENEW_INCORRECT_EXPIRY_DATE", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "srsgw.domainRenewExtension" ], "Maturity" : "GAMMA", "Summary" : "Domain synchronisation" }, "srsgw-06" : { "Description" : "This test confirms that transfer requests submitted in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit `` commands for a pseudo-randomly generated domain name.\nContact and nameserver will be created if required. The server **MUST**\nrespond with a 1000 or 1001 response. It will then submit an ``\ncommand to set an authInfo code for the domain. The server **MUST**\nrespond with a 1000 or 1001 response.\n\nIt will then reconnect to the SRS Gateway EPP system using the credentials\nof a second registrar account and submit a `` The\nserver **MUST** respond with a 1000 or 1001 response.\n\nIt will wait for 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command for the domain. The server\n**MUST** respond with a 1000 response.\n\n* If the response to the original `` command was\n `1000`, then the value of the `` element **MUST** correspond to the\n ID of the client which submitted the transfer request.\n* If the response to the `` command was `1001`, then\n the domain **MUST** have the `pendingTransfer` status.\n\nIf the response to the `` command is 1001, then the\nclient will connect to the SRS Gateway EPP system, authenticate, and\nperform an `` command. The server **MUST** respond\nwith a 1000 or 1001 response.\n\nIt will wait for 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command for the domain. The server\n**MUST** respond with a 1000 response. The `` element **MUST**\ncontain the ID of the client which submitted the transfer request.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_GENERIC_COMMAND_ERROR", "EPP_LOGIN_ERROR", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "SRSGW_DOMAIN_TRANSFER_APPROVAL_FAILED", "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_HAS_INCORRECT_CLID", "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_NOT_UPDATED_WITHIN_DEADLINE", "SRSGW_DOMAIN_TRANSFER_APPROVAL_OBJECT_STILL_PENDING_TRANSFER", "SRSGW_DOMAIN_TRANSFER_REQUEST_FAILED", "SRSGW_DOMAIN_TRANSFER_REQUEST_OBJECT_NOT_PENDING_TRANSFER", "SRSGW_DOMAIN_TRANSFER_REQUEST_OBJECT_NOT_UPDATED_WITHIN_DEADLINE", "SRSGW_EPP_INVALID_EXTENSION", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "srsgw.domainTransferRequestExtension", "srsgw.domainTransferApproveExtension" ], "Maturity" : "GAMMA", "Summary" : "Domain synchronisation" }, "srsgw-08" : { "Description" : "This test confirms that domain objects deleted in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit `` commands for a pseudo-randomly generated domain name.\nContact and nameserver will be created if required. The server **MUST**\nrespond with a 1000 or 1001 response.\n\nIt will wait for 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command. The server **MUST**\nrespond with a 1000 response.\n\nThe client will then reconnect to the SRS Gateway EPP system, authenticate,\nand submit a `` command. The server **MUST** respond with a 1001\nresponse.\n\nFinally, the client will wait for 30 seconds, and then reconnect to the\nprimary EPP system, authenticate, and confirm that:\n\n* if the SRS Gateway EPP server responded to the `` command with a\n `1000` response, then the domain no longer exists;\n* if the SRS Gateway EPP server responded to the `` command with a\n `1001` response, then (a) the domain no longer exists (as it has been\n purged) or (b) the domain has the `pendingDelete` status and have an RGP\n status of `redemptionPeriod`.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_DOMAIN_DELETE_FAILED", "SRSGW_DOMAIN_DELETE_DOMAIN_NOT_PENDINGDELETE", "SRSGW_DOMAIN_DELETE_RGP_STATUS_NOT_REDEMPTIONPERIOD", "SRSGW_EPP_INVALID_EXTENSION", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION" ], "Input-Parameters" : [ "srsgw.domainDeleteExtension" ], "Maturity" : "GAMMA", "Summary" : "Domain synchronisation" }, "srsgw-09" : { "Description" : "This test confirms that host objects updated in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nIf the value of the `epp.hostModel` input parameter is `attributes`, then\nthis test will be skipped.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated host name.\nIP address information will be provided if required. The server **MUST**\nrespond with a 1000 or 1001 response.\n\nThe test client will then perform an `` command that will change the\nstatus codes and IP addresses. It will then perform an `` command and\ncapture the response.\n\nIt will wait for 30 seconds, and then connect to the primary registry EPP\nserver and perform an `` command for the same object.\n\nThe two `` responses **MUST** be identical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_EPP_HOST_UPDATE_FAILED", "SRSGW_EPP_HOST_UPDATE_INFO_RESPONSES_DIFFER", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host synchronization (if applicable)" }, "srsgw-10" : { "Description" : "This test confirms that host objects deleted in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nIf the value of the `epp.hostModel` input parameter is `attributes`, then\nthis test will be skipped.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated host name.\nIP address information will be provided if required. The server **MUST**\nrespond with a 1000 response.\n\nThe client will wait 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command. The server **MUST** respond\nwith a 1000 response.\n\nThe client will then perform a `` command via the SRS Gateway EPP\nsystem, which **MUST** result in a 1000 response.\n\nFinally, the client will wait for another 30 seconds, and perform an\n`` command on the primary registry EPP server.\n\nThe server **MUST** respond with a 2303 \"object does not exist\" response.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_EPP_HOST_DELETE_FAILED", "SRSGW_EPP_HOST_DELETE_OBJECT_STILL_EXISTS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Host synchronization (if applicable)" }, "srsgw-11" : { "Description" : "This test confirms that contact objects updated in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nIf the `srsgw.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `srsgw.eppClid01DataModel`\nand `srsgw.eppClid02DataModel` input parameters.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated contact\nobject.\n\nThe test client will then perform an `` command that will change the\nstatus codes and contact information. It will then perform an ``\ncommand and capture the response.\n\nIt will wait for 30 seconds, and then connect to the primary registry EPP\nserver and perform an `` command for the same object.\n\nThe two `` responses **MUST** be identical.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_EPP_CONTACT_UPDATE_FAILED", "SRSGW_EPP_CONTACT_UPDATE_INFO_RESPONSES_DIFFER", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Contact synchronization (if applicable)" }, "srsgw-12" : { "Description" : "This test confirms that contact objects delete in the SRS Gateway EPP\nsystem are correctly synchronized with the primary registry system.\n\nIf the `srsgw.registryDataModel` input parameter is `minimum`, this\ntest will be skipped. Otherwise, this client will select the appropriate\nregistrar credentials based on the values of the `srsgw.eppClid01DataModel`\nand `srsgw.eppClid02DataModel` input parameters.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated contact\nobject.\n\nThe client will wait 30 seconds, and then connect to the primary EPP system,\nauthenticate, and perform an `` command. The server **MUST** respond\nwith a 1000 response.\n\nThe client will then perform a `` command via the SRS Gateway EPP\nsystem, which **MUST** result in a 1000 response.\n\nFinally, the client will wait for another 30 seconds, and perform an\n`` command on the primary registry EPP server.\n\nThe server **MUST** respond with a 2303 \"object does not exist\" response.\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_EPP_CONTACT_DELETE_FAILED", "SRSGW_EPP_CONTACT_DELETE_OBJECT_STILL_EXISTS", "EPP_GENERIC_COMMAND_ERROR", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Contact synchronization (if applicable)" }, "srsgw-13" : { "Description" : "This test confirms that the SRS Gateway's RDAP service provides responses\nto domain lookups that match those of the primary registry RDAP server.\n\nThe test system will connect to the SRS Gateway EPP server and create one\ndomain name for each TLD in the TLD set, and any required host and/or\ncontact objects. This stage **MUST** complete successfully. Then, after 30\nseconds, it will perform RDAP queries for those domains against both the\nprimary registry RDAP server and the SRS Gateway RDAP server. The RDAP\nrequests **MUST** be successful.\n\nAfter canonicalization (see [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785)),\nthe JSON responses from each server **MUST** be identical, with the sole\nexception of event objects with `eventAction` properties equal to \"last\nupdate of RDAP database\".\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_RDAP_DNS_RESOLUTION_ERROR", "SRSGW_RDAP_SERVICE_PORT_UNREACHABLE", "SRSGW_RDAP_TLS_CONNECTION_ERROR", "SRSGW_RDAP_QUERY_FAILED", "SRSGW_RDAP_RESPONSES_DIFFER", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Domain RDAP synchronization" }, "srsgw-14" : { "Description" : "This test confirms that the SRS Gateway's RDAP service provides responses\nto nameserver lookups that match those of the primary registry RDAP server.\n\nIf the value of the `epp.hostModel` input parameter is `attributes`, then\nthis test will be skipped.\n\nFor each TLD in the TLD set, the client will connect to the SRS Gateway EPP\nsystem, authenticate, and submit a `` command for a pseudo-randomly\ngenerated host name. IP address information will be provided if required.\nThe server **MUST** respond with a 1000 or 1001 response.\n\nThe test system will perform RDAP queries for each created object against\nboth the primary registry RDAP server and the SRS Gateway RDAP server for\nthe relevant TLD.\n\nAfter canonicalization (see [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785)),\nthe JSON responses from each server **MUST** be identical, with the sole\nexception of event objects with `eventAction` properties equal to \"last\nupdate of RDAP database\".\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_RDAP_DNS_RESOLUTION_ERROR", "SRSGW_RDAP_SERVICE_PORT_UNREACHABLE", "SRSGW_RDAP_TLS_CONNECTION_ERROR", "SRSGW_RDAP_QUERY_FAILED", "SRSGW_RDAP_RESPONSES_DIFFER", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Nameserver RDAP synchronization" }, "srsgw-15" : { "Description" : "This test confirms that the SRS Gateway's RDAP service provides responses\nto registrar (entity) lookups that match those of the primary registry\nRDAP server.\n\nThe client will connect to the SRS Gateway EPP system, authenticate, and\nsubmit a `` command for a pseudo-randomly generated domain name.\nHost and/or contact objects will created as needed.\n\nThe test system will then perform RDAP queries for this domain against the\nprimary registry RDAP server in order to obtain the `handle` property of the\nentity with the `registrar` role. It will then construct two URLs using this\nvalue and the values of the `rdap.baseURLs` and `srsgw.rdapBaseURLs` input\nparameters. It will then retrieve those URLs.\n\nAfter canonicalization (see [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785)),\nthe JSON responses from each server **MUST** be identical, with the sole\nexception of event objects with `eventAction` properties equal to \"last\nupdate of RDAP database\".\n", "Errors" : [ "EPP_DNS_RESOLUTION_ERROR", "EPP_SERVICE_PORT_UNREACHABLE", "EPP_NO_SERVICE_PORTS_REACHABLE", "EPP_TLS_CONNECTION_ERROR", "EPP_XML_PARSE_ERROR", "EPP_SCHEMA_VALIDATION_ERROR", "EPP_LOGIN_ERROR", "SRSGW_RDAP_DNS_RESOLUTION_ERROR", "SRSGW_RDAP_SERVICE_PORT_UNREACHABLE", "SRSGW_RDAP_TLS_CONNECTION_ERROR", "SRSGW_RDAP_QUERY_FAILED", "SRSGW_RDAP_RESPONSES_DIFFER", "EPP_INVALID_EXTENSION", "SRSGW_EPP_INVALID_EXTENSION" ], "Maturity" : "GAMMA", "Summary" : "Registrar RDAP synchronization" } }, "Test-Plans" : { "AdditionalDNSTransportsTest" : { "Description" : "Registry Operators may optionally provide authoritative DNS services over\nadditional transports, such as TLS, HTTPS and QUIC.\n\nThis test plan uses the `AdditionalDNSTransports` test suite to verify the\nconformance of these services with the relevant RFCs.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "Additional DNS Transports Test", "Order" : "210", "Test-Suites" : [ "AdditionalDNSTransports" ] }, "DNSRSPChangeTest" : { "Description" : "A Registry Operator may apply to ICANN to change a Material Subcontracting\nArrangement (MSA) and appoint a new provider of authoritative DNS services\ninstead of or in addition to any existing provider(s).\n\nBefore this change can be approved, the new DNS provider **MUST** complete\ntesting to ensure their systems comply with the technical and operational\nrequirements of the Registry Agreement.\n\nThe DNS RSP Change Test uses the DNS test suite only.\n\n**Note on test environment:** this is a \"business as usual\" test, designed to test a soon-to-be or already delegated TLD. Therefore, all input parameters provided **MUST** relate to the production registry environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "DNS RSP Change Test", "OTE-Only" : "", "Order" : "130", "Test-Suites" : [ "StandardDNS", "StandardDNSSEC" ] }, "DNSRSPEvaluationTest" : { "Description" : "DNS RSPs provide primary or secondary authoritative DNS services. Therefore,\nthis test plan only covers the DNS area.\n\nRSPs wishing to offer DNSSEC services in addition to authoritative DNS will\nalso be evaluated using the DNSSEC RSP Evaluation Test.\n\nUnlike the \"business as usual\" test plans (e.g. The Pre-Delegation Test) the\nTLD string(s) that will be used will not be real (delegated or applied-for)\nTLDs but test TLDs that will be determined by ICANN. Test subjects will be\nrequired to configure their systems to support these TLDs prior to the start\nof the test run.\n\n**Note on test environment:** this test is designed to be used as part of the RSP evaluation program. Therefore, input parameters **MAY** be provided the relate to a test, staging or OT&E environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "DNS RSP Evaluation Test", "OTE-Only" : "", "Order" : "180", "Test-Suites" : [ "StandardDNS" ] }, "DNSSECOperationsOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `DNSSECOperations` suite.\n", "Name" : "DNSSEC Operations (test suite)", "OTE-Only" : "1", "Order" : "290", "Test-Suites" : [ "DNSSECOperations" ] }, "DNSSECRSPEvaluationTest" : { "Description" : "DNSSEC RSPs provide signing of TLD zone files as a service. They do not\nprovide primary or secondary authoritative DNS services.\n\nRSPs wishing to offer authoritative DNS services in addition to\nauthoritative DNS will also be evaluated using the DNS RSP Evaluation Test.\n\nUnlike the \"business as usual\" test plans (e.g. The Pre-Delegation Test) the\nTLD string(s) that will be used will not be real (delegated or applied-for)\nTLDs but test TLDs that will be determined by ICANN. Test subjects will be\nrequired to configure their systems to support these TLDs prior to the start\nof the test run.\n\n**Note on test environment:** this test is designed to be used as part of the RSP evaluation program. Therefore, input parameters **MAY** be provided the relate to a test, staging or OT&E environment.\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "DNSSEC RSP Evaluation Test", "OTE-Only" : "", "Order" : "190", "Test-Suites" : [ "StandardDNSSEC", "DNSSECOperations" ] }, "MainRSPEvaluationTest" : { "Description" : "The Main RSP is responsible for the creation and maintenance of domain name\nregistrations in a Shared Registration System (SRS). This encompasses the\nlifecycle of a domain name registration using domain registrars and\nprotocols such as the Extensible Provisioning Protocol (EPP) and adherence\nto policies regarding the use and transparency domain name registrations\nthrough reporting, the Registration Data Access Protocol (RDAP), and other\nmechanisms.\n\nUnlike the \"business as usual\" test plans (e.g. The Pre-Delegation Test) the\nTLD string(s) that will be used will not be real (delegated or applied-for)\nTLDs but test TLDs that will be determined by ICANN. Test subjects will be\nrequired to configure their systems to support these TLDs prior to the start\nof the test run.\n\n**Note on test environment:** this test is designed to be used as part of the RSP evaluation program. Therefore, input parameters **MAY** be provided the relate to a test, staging or OT&E environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "Main RSP Evaluation Test", "OTE-Only" : "", "Order" : "170", "Test-Suites" : [ "StandardEPP", "MinimumRPMs", "StandardRDAP", "StandardRDE" ] }, "MinimumRPMsOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `MinimumRPMs` suite.\n", "Name" : "Minimum RPMs (test suite)", "OTE-Only" : "1", "Order" : "280", "Test-Suites" : [ "MinimumRPMs" ] }, "PreDelegationTestWithSRSGateway" : { "Description" : "This test plan is identical to the Pre-Delegation Test plan, but adds the\nSRS Gateway test suite, for TLDs which intend to launch with an SRS Gateway.\n", "Name" : "Pre-Delegation Test with SRS Gateway", "OTE-Only" : "", "Order" : "110", "Test-Suites" : [ "StandardDNS", "StandardDNSSEC", "StandardEPP", "StandardRDAP", "StandardIDN", "StandardRDE", "StandardIntegrationTest", "StandardSRSGateway" ] }, "RSPEvaluationIDNTest" : { "Description" : "This test plan is identical to the Standard IDN Test, but is intended\nsolely for use in the RSP evaluation program.\n\nOne key difference between this plan and the Standard IDN Test is that the\nTLD string(s) that will be used will not be real (delegated or applied-for)\nTLDs but test TLDs that will be determined by ICANN. Test subjects will be\nrequired to configure their systems to support these TLDs prior to the start\nof the test run.\n\n**Note on test environment:** this test is designed to be used as part of the RSP evaluation program. Therefore, input parameters **MAY** be provided the relate to a test, staging or OT&E environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "IDN Test (RSP Evaluation)", "OTE-Only" : "", "Order" : "171", "Test-Suites" : [ "StandardIDN" ] }, "SRSGatewayRSPTest" : { "Description" : "SRS Gateway RSPs provide a proxy between a subset of Registrars and the\nRegistry. It uses a local cache to speed up EPP query commands, but forwards\nall EPP transform commands to the primary registry system. TLD registries\nneed to deploy a proxy setup in order to operate in certain markets\nworldwide.\n\nThe [SRS Gateway test suite](#Test-Suite-StandardSRSGateway) requires access\nto a primary registry system that is logically independent of the SRS\nGateway system, and details of the primary registry system are required as\ninput parameters.\n\nRSPs wishing to offer SRS gateway services **MUST** identify such a primary\nregistry system, which **MUST** be independent of the SRS gateway system,\nand **MAY** be operated by a third party.\n\nUnlike the \"business as usual\" test plans (e.g. The Pre-Delegation Test) the\nTLD string(s) that will be used will not be real (delegated or applied-for)\nTLDs but test TLDs that will be determined by ICANN. Test subjects will be\nrequired to configure their systems to support these TLDs prior to the start\nof the test run.\n\n**Note on test environment:** this test is designed to be used as part of the RSP evaluation program. Therefore, input parameters **MAY** be provided the relate to a test, staging or OT&E environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "SRS Gateway RSP Evaluation Test", "OTE-Only" : "", "Order" : "200", "Test-Suites" : [ "StandardSRSGateway" ] }, "SRSGatewayTest" : { "Description" : "An SRS Gateway service is a Shared Registry System implementation that acts\nas a proxy between a subset of Registrars and the Registry. It uses a local\ncache to speed up EPP query commands, but forwards all EPP transform\ncommands to the primary registry system. TLD registries need to deploy a\nproxy setup in order to operate in certain markets worldwide.\n\nThe purpose of an SRS Gateway Test is to verify that the Registry Operator’s\nproxy setup operates in accordance with the technical and operational\ncriteria for EPP systems described in the gTLD Applicant Guidebook (AGB).\nFurthermore, it **MUST** keep its own database synchronized with that of the\nTLD registry.\n\nThe SRS Gateway Test Change Test uses the SRS gateway test suite only.\n\n**Note on test environment:** this is a \"business as usual\" test, designed to test a soon-to-be or already delegated TLD. Therefore, all input parameters provided **MUST** relate to the production registry environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "SRS Gateway Test", "OTE-Only" : "", "Order" : "160", "Test-Suites" : [ "StandardSRSGateway", "SRSGatewayIntegrationTest" ] }, "StandardDNSOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardDNS` suite.\n", "Name" : "DNS (test suite)", "OTE-Only" : "1", "Order" : "220", "Test-Suites" : [ "StandardDNS" ] }, "StandardDNSSECOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardDNSSEC` suite.\n", "Name" : "DNSSEC (test suite)", "OTE-Only" : "1", "Order" : "230", "Test-Suites" : [ "StandardDNSSEC" ] }, "StandardEPPOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardEPP` suite.\n", "Name" : "EPP (test suite)", "OTE-Only" : "1", "Order" : "250", "Test-Suites" : [ "StandardEPP" ] }, "StandardIDNTest" : { "Description" : "A Registry Operator may apply to ICANN to amend its Registry Agreement\nto offer new scripts and/or languages for Internationalized Domain Names.\n\nThe purpose of an IDN RST test is to verify that the Registry Operator’s\nregistry system handles IDN registrations in accordance with the\nsubmitted policy statements and IDN tables.\n\nThe IDN Test uses the IDN test suite only.\n\n**Note on test environment:** this is a \"business as usual\" test, designed to test a soon-to-be or already delegated TLD. Therefore, all input parameters provided **MUST** relate to the production registry environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "IDN Test", "OTE-Only" : "", "Order" : "140", "Test-Suites" : [ "StandardIDN" ] }, "StandardIntegrationTestOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardIntegrationTest ` suite.\n", "Name" : "Integration Test (test suite)", "OTE-Only" : "1", "Order" : "300", "Test-Suites" : [ "StandardIntegrationTest" ] }, "StandardPreDelegationTest" : { "Description" : "The purpose of the Pre-Delegation Test is to verify that the applicant has\nmet its commitment to establish registry operations in accordance with the\ntechnical and operational criteria described in the gTLD Applicant Guidebook\n(AGB). Each applicant will be required to complete PDT as a prerequisite to\ndelegation into the root zone.\n\nThe Pre-Delegation Test covers all critical registry services and IDNs, and\ntherefore uses all standard test suites.\n\n**Note on test environment:** this is a \"business as usual\" test, designed to test a soon-to-be or already delegated TLD. Therefore, all input parameters provided **MUST** relate to the production registry environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "Pre-Delegation Test", "OTE-Only" : "", "Order" : "100", "Test-Suites" : [ "StandardDNS", "StandardDNSSEC", "StandardEPP", "StandardRDAP", "StandardIDN", "StandardRDE", "StandardIntegrationTest" ] }, "StandardRDAPOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardRDAP` suite.\n", "Name" : "RDAP (test suite)", "OTE-Only" : "1", "Order" : "240", "Test-Suites" : [ "StandardRDAP" ] }, "StandardRDEOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardRDE` suite.\n", "Name" : "RDE (test suite)", "OTE-Only" : "1", "Order" : "260", "Test-Suites" : [ "StandardRDE" ] }, "StandardRSPChangeTest" : { "Description" : "A Registry Operator may apply to ICANN to change a Material Subcontracting\nArrangement (MSA) and appoint a new Registry Services Provider. Before\nthis change can be approved, the new RSP **MUST** complete Registry System\nTesting to ensure their systems comply with the technical and operational\nrequirements of the Registry Agreement.\n\nThe RSP Change Test covers all critical registry services and IDNs, and\ntherefore uses all test standard suites.\n\n**Note on test environment:** this is a \"business as usual\" test, designed to test a soon-to-be or already delegated TLD. Therefore, all input parameters provided **MUST** relate to the production registry environment.\n\n# Pass/fail criteria\n\nAs with all other [test plans](#test-plans), for this test to pass, **all** the listed test cases **MUST** pass: if **any** fail, then the test as a whole will fail.\n", "Name" : "RSP Change Test", "OTE-Only" : "", "Order" : "120", "Test-Suites" : [ "StandardDNS", "StandardDNSSEC", "StandardEPP", "StandardIDN", "StandardRDAP", "StandardRDE", "StandardIntegrationTest" ] }, "StandardSRSGatewayOnly" : { "Description" : "This test plan allows an RSP to request testing of a single test suite,\nspecifically the `StandardSRSGateway` suite.\n", "Name" : "SRS Gateway (test suite)", "OTE-Only" : "1", "Order" : "270", "Test-Suites" : [ "StandardSRSGateway" ] } }, "Test-Suites" : { "AdditionalDNSTransports" : { "Description" : "This test suite verifies that Registry Operators wishing to offer their\nauthoritative DNS service over additional transport protocols (specifically\nTLS, HTTPS and QUIC) can do so in conformance with the relevant RFCs.\n\n# References\n\n* [RFC 7858 - Specification for DNS over Transport Layer Security (TLS)](https://www.rfc-editor.org/rfc/rfc7858.html)\n* [RFC 8484 - DNS Queries over HTTPS (DoH)](https://www.rfc-editor.org/rfc/rfc8484.html)\n* [RFC 9250 - DNS over Dedicated QUIC Connections](https://www.rfc-editor.org/rfc/rfc9250.html)\n", "Input-Parameters" : [ "dns.nameservers" ], "Name" : "Additional DNS Transports", "Order" : "11", "Test-Cases" : [ "dns-zz-consistency" ] }, "DNSSECOperations" : { "Description" : "This test suite verifies the ability of an RSP to carry out standard DNSSEC\noperational procedures while maintaining a chain of trust to the parent\nzone.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 6781 - DNSSEC Operational Practices, Version 2](https://www.rfc-editor.org/rfc/rfc6781.html)\n", "Input-Parameters" : [ "dnssecOps.nameservers", "dnssecOps.primaryServers", "dnssecOps.tsigKey" ], "Name" : "DNSSEC Operations", "Order" : "8", "Resources" : [ "dnssecOps.xfrACL" ], "Test-Cases" : "^dnssecOps" }, "MinimumRPMs" : { "Description" : "This test suite verifies an RSP's support for the minimum Rights Protection\nMechanisms (RPMs), and the Launch Extension ([RFC 8334](https://www.rfc-editor.org/rfc/rfc8334.html)).\n\n*Note:* RSPs do not need access to the TMCH system for this test suite, as\nthe test cases use the publicly-available test materials.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 8334 - Launch Phase Mapping for the Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc8334.html)\n* [RFC 9361 - ICANN Trademark Clearinghouse (TMCH) Functional Specifications](https://www.rfc-editor.org/rfc/rfc9361.html)\n* [Trademark Clearinghouse - Rights Protection Mechanism Requirements](https://newgtlds.icann.org/sites/default/files/rpm-requirements-14may14-en.pdf) (PDF)\n", "Input-Parameters" : [ "epp.clid01", "epp.clid01DataModel", "epp.clid02", "epp.clid02DataModel", "epp.hostModel", "epp.hostName", "epp.pwd01", "epp.pwd02", "epp.requiredContactElements", "epp.requiredContactTypes", "epp.serverIssuedClientCertificate01", "epp.serverIssuedClientCertificate02", "epp.supportedContactElements", "epp.loginExtension", "epp.supportedContactPostalInfoTypes", "general.registryDataModel", "minimumRPMS.claimsTLD", "minimumRPMS.sunriseModel", "minimumRPMS.sunriseTLD" ], "Name" : "Minimum Rights Protection Mechanisms (RPMs)", "Order" : "9", "Resources" : [ "tmch.testCert", "tmch.testCRL", "tmch.testDNL", "tmch.testSMDRL", "tmch.testSURL", "epp.client01ChainCert", "epp.client02ChainCert" ], "Test-Cases" : "^minimumRPMs-" }, "StandardDNS" : { "Description" : "The DNS test suite validates the authoritative DNS services for the TLD(s)\nor RSP.\n\nMost of the test cases in the DNS test suite are derived from the test plans\nin version **v2025.2.1\n ** of [Zonemaster](https://github.com/zonemaster).\n\nZonemaster will test each of the TLDs in the test using the nameservers\nprovided in the `dns.nameservers` input parameter.\n\nSince Zonemaster is designed to perform testing of domain names anywhere in the DNS hierarchy, not all Zonemaster tests are applicable for TLDs and may not be listed in the test suites in this document.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\nUnless stated otherwise, the pass/fail criteria for the test cases in this suite are the same as those defined in the Zonemaster documentation: that is, if Zonemaster reports that a test case has an `ERROR` or `CRITICAL` result, then the corresponding test case in this suite will fail. `INFO`, `NOTICE` and `WARNING` results will not result in a failed test case. Error codes in this suite are prefixed with `ZM_` which map onto the message tags used by Zonemaster. Test cases must pass for all TLDs in the TLD set.\n\n# References\n\nNote: this list of references is not exhaustive.\n\n* [RFC 1034 - Domain names - concepts and facilities](https://www.rfc-editor.org/rfc/rfc1034.html)\n* [RFC 1035 - Domain names - implementation and specification](https://www.rfc-editor.org/rfc/rfc1035.html)\n* [RFC 1123 - Requirements for Internet Hosts - Application and Support](https://www.rfc-editor.org/rfc/rfc1123.html)\n* [RFC 1982 - Serial Number Arithmetic](https://www.rfc-editor.org/rfc/rfc1982.html)\n* [RFC 2181 - Clarifications to the DNS Specification](https://www.rfc-editor.org/rfc/rfc2181.html)\n* [RFC 2182 - Selection and Operation of Secondary DNS Servers](https://www.rfc-editor.org/rfc/rfc2182.html)\n* [RFC 3226 - DNSSEC and IPv6 A6 aware server/resolver message size requirements](https://www.rfc-editor.org/rfc/rfc3226.html)\n* [RFC 3596 - DNS Extensions to Support IP Version 6](https://www.rfc-editor.org/rfc/rfc3596.html)\n* [RFC 3597 - Handling of Unknown DNS Resource Record (RR) Types](https://www.rfc-editor.org/rfc/rfc3597.html)\n* [RFC 4343 - Domain Name System (DNS) Case Insensitivity Clarification](https://www.rfc-editor.org/rfc/rfc4343.html)\n* [RFC 5966 - DNS Transport over TCP - Implementation Requirements](https://www.rfc-editor.org/rfc/rfc5966.html)\n* [RFC 6891 - Extension Mechanisms for DNS (EDNS(0))](https://www.rfc-editor.org/rfc/rfc6891.html)\n", "Input-Parameters" : [ "dns.nameservers" ], "Name" : "Authoritative DNS Service", "Order" : "1", "Test-Cases" : "^dns-" }, "StandardDNSSEC" : { "Description" : "The DNS test suite validates the authoritative DNS services for the TLD(s)\nRSP.\n\nMost of the test cases in the DNS test suite are derived from the test plans\nin version **v2025.2.1\n ** of [Zonemaster](https://github.com/zonemaster).\n\nZonemaster will test each of the TLDs in the test using the nameservers\nprovided in the `dns.nameservers` input parameter.\n\nSince Zonemaster is designed to perform testing of domain names anywhere in the DNS hierarchy, not all Zonemaster tests are applicable for TLDs and may not be listed in the test suites in this document.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\nUnless stated otherwise, the pass/fail criteria for the test cases in this suite are the same as those defined in the Zonemaster documentation: that is, if Zonemaster reports that a test case has an `ERROR` or `CRITICAL` result, then the corresponding test case in this suite will fail. `INFO`, `NOTICE` and `WARNING` results will not result in a failed test case. Error codes in this suite are prefixed with `ZM_` which map onto the message tags used by Zonemaster. Test cases must pass for all TLDs in the TLD set.\n\n# References\n\nNote: this list of references is not exhaustive.\n\n* [RFC 4033 - DNS Security Introduction and Requirements](https://www.rfc-editor.org/rfc/rfc4033.html)\n* [RFC 4034 - Resource Records for the DNS Security Extensions](https://www.rfc-editor.org/rfc/rfc4034.html)\n* [RFC 4035 - Protocol Modifications for the DNS Security Extensions](https://www.rfc-editor.org/rfc/rfc4035.html)\n* [RFC 4509 - Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)](https://www.rfc-editor.org/rfc/rfc4509.html)\n* [RFC 5155 - DNS Security (DNSSEC) Hashed Authenticated Denial of Existence](https://www.rfc-editor.org/rfc/rfc5155.html)\n* [RFC 6841 - A Framework for DNSSEC Policies and DNSSEC Practice Statements](https://www.rfc-editor.org/rfc/rfc6841.html)\n* [RFC 9276 - Guidance for NSEC3 Parameter Settings](https://www.rfc-editor.org/rfc/rfc9276.html)\n", "Input-Parameters" : [ "dns.nameservers", "dnssec.dsRecords" ], "Name" : "DNS Security Extensions (DNSSEC)", "Order" : "2", "Test-Cases" : "^dnssec-" }, "StandardEPP" : { "Description" : "The EPP test suite validates the EPP service of the TLD(s) or RSP. It\nverifies that the EPP server properly implements the query and transform\ncommands specified for domain names (and optionally host and contact\nobjects) and the mandatory extensions.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 5730 - Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc5730.html)\n* [RFC 5731 - Extensible Provisioning Protocol (EPP) Domain Name Mapping](https://www.rfc-editor.org/rfc/rfc5731.html)\n* [RFC 5732 - Extensible Provisioning Protocol (EPP) Host Mapping](https://www.rfc-editor.org/rfc/rfc5732.html)\n* [RFC 5733 - Extensible Provisioning Protocol (EPP) Contact Mapping](https://www.rfc-editor.org/rfc/rfc5733.html)\n* [RFC 5734 - Extensible Provisioning Protocol (EPP) Transport over TCP](https://www.rfc-editor.org/rfc/rfc5734.html)\n* [RFC 3735 - Guidelines for Extending the Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc3735.html)\n* [RFC 7451 - Extension Registry for the Extensible Provisioning Protocol](https://www.rfc-editor.org/rfc/rfc7451.html)\n* [RFC 3915 - Domain Registry Grace Period Mapping for the Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc3915.html)\n* [RFC 5910 - Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc5910.html)\n* [RFC 8807 - Login Security Extension for the Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc8807.html)\n* [RFC 9154 - Extensible Provisioning Protocol (EPP) Secure Authorization Information for Transfer](https://www.rfc-editor.org/rfc/rfc9154.html)\n* [RFC 9325 - Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)](https://www.rfc-editor.org/rfc/rfc9325.html)\n", "Input-Parameters" : [ "general.registryDataModel", "epp.clid01", "epp.pwd01", "epp.serverIssuedClientCertificate01", "epp.clid01DataModel", "epp.clid02", "epp.pwd02", "epp.serverIssuedClientCertificate02", "epp.clid02DataModel", "epp.hostModel", "epp.hostName", "epp.registeredNames", "epp.requiredContactTypes", "epp.supportedContactElements", "epp.requiredContactElements", "epp.loginExtension", "epp.secDNSInterfaces", "epp.supportedContactPostalInfoTypes" ], "Name" : "Extensible Provisioning Protocol (EPP)", "Order" : "4", "Resources" : [ "epp.clientACL", "epp.client01CSR", "epp.client01Certificate", "epp.client01ChainCert", "epp.client02CSR", "epp.client02Certificate", "epp.client02ChainCert" ], "Test-Cases" : "^epp-" }, "StandardIDN" : { "Description" : "The IDN test suite validates the IDN table implementation for the TLD(s) or\nRSP, including compliance with specifications for variant labels at the top-\nor second-level, and conformance with the IDN Implementation Guidelines.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 5890 - Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework](https://www.rfc-editor.org/rfc/rfc5890.html)\n* [RFC 5891 - Internationalized Domain Names in Applications (IDNA): Protocol](https://www.rfc-editor.org/rfc/rfc5891.html)\n* [RFC 5892 - The Unicode Code Points and Internationalized Domain Names for Applications (IDNA)](https://www.rfc-editor.org/rfc/rfc5892.html)\n* [RFC 5893 - Right-to-Left Scripts for Internationalized Domain Names for Applications (IDNA)](https://www.rfc-editor.org/rfc/rfc5893.html)\n* [RFC 5894 - Internationalized Domain Names for Applications (IDNA): Background, Explanation, and Rationale](https://www.rfc-editor.org/rfc/rfc5894.html)\n* [IDN Implementation Guidelines](https://www.icann.org/en/topics/idn/implementation-guidelines.htm)\n", "Input-Parameters" : [ "epp.clid01", "epp.clid01DataModel", "epp.clid02", "epp.clid02DataModel", "epp.hostModel", "epp.hostName", "epp.pwd01", "epp.pwd02", "epp.registeredNames", "epp.requiredContactElements", "epp.requiredContactTypes", "epp.serverIssuedClientCertificate01", "epp.serverIssuedClientCertificate02", "epp.supportedContactElements", "general.registryDataModel", "epp.loginExtension", "epp.supportedContactPostalInfoTypes" ], "Name" : "Internationalized Domain Names (IDN)", "Order" : "6", "Resources" : [ "epp.clientACL", "epp.client01CSR", "epp.client02CSR", "epp.client01Certificate", "epp.client02Certificate", "epp.client01ChainCert", "epp.client02ChainCert", "idn.testLabelsForOTE" ], "Test-Cases" : "^idn-" }, "StandardIntegrationTest" : { "Description" : "This test suite verifies that the critical registry services of a TLD are\nproperly integrated and functioning within the requirements of the Service\nLevel Agreement.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* Specification 10 of the [Base Registry Agreement](https://www.icann.org/en/registry-agreements/base-agreement)\n* [ICANN Registry Interfaces (draft-lozano-icann-registry-interfaces)](https://datatracker.ietf.org/doc/html/draft-lozano-icann-registry-interfaces)\n", "Input-Parameters" : [ "dns.gluePolicy", "dns.nameservers", "epp.clid01", "epp.clid01DataModel", "epp.clid02", "epp.clid02DataModel", "epp.hostModel", "epp.hostName", "epp.loginExtension", "epp.pwd01", "epp.pwd02", "epp.registeredNames", "epp.requiredContactElements", "epp.requiredContactTypes", "epp.serverIssuedClientCertificate01", "epp.serverIssuedClientCertificate02", "epp.supportedContactElements", "epp.supportedContactPostalInfoTypes", "general.registryDataModel" ], "Name" : "Registry Services Integration", "Order" : "10", "Resources" : [ "tmch.testCert", "tmch.testCRL", "tmch.testDNL", "tmch.testSMDRL", "tmch.testSURL", "epp.client01ChainCert", "epp.client02ChainCert" ], "Test-Cases" : "^integration-" }, "StandardRDAP" : { "Description" : "The RDAP test suite validates the RDAP service of the TLD(s) or RSP.\n\nThe RDAP test suite uses the [RDAP Conformance\nTool](https://github.com/icann/rdap-conformance-tool) to perform conformance\ntesting of RDAP services.\n\nThe RDAP Conformance Tool checks that an RDAP server properly implements the\nRDAP RFCs and the [gTLD RDAP Profile](https://icann.org/gtld-rdap-profile).\n\nThe RDAP Conformance Tool will be used to check the RDAP services for each\nTLD in the test using the Base URL(s) specified in the `rdap.baseURLs` input\nparameter.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 7480 - HTTP Usage in the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc7480.html)\n* [RFC 7481 - Security Services for the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc7481.html)\n* [RFC 9083 - JSON Responses for the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc9083.html)\n* [gTLD RDAP Profile](https://www.icann.org/gtld-rdap-profile)\n", "Input-Parameters" : [ "rdap.baseURLs", "rdap.testDomains", "rdap.testEntities", "rdap.testNameservers", "rdap.profileVersion", "epp.hostModel" ], "Name" : "Registration Data Access Protocol (RDAP)", "Order" : "3", "Resources" : [ "rdap.clientACL" ], "Test-Cases" : "^rdap-" }, "StandardRDE" : { "Description" : "The RDE test suite validates Registry Data Escrow deposits generated for\nthe TLD(s) or RSP. These deposits **MUST** comply with the specifications in\nthe Registry Agreement and with [RFC\n8909](https://www.rfc-editor.org/rfc/rfc8909.html) and [RFC\n9022](https://www.rfc-editor.org/rfc/rfc9022.html).\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [RFC 8909 - Registry Data Escrow Specification](https://www.rfc-editor.org/rfc/rfc8909.html)\n* [RFC 9022 - Domain Name Registration Data (DNRD) Objects Mapping](https://www.rfc-editor.org/rfc/rfc9022.html)\n* Specification 2, Part A, Sections 3 & 4 of the [Base Registry Agreement](https://www.icann.org/en/registry-agreements/base-agreement)\n", "Input-Parameters" : [ "rde.depositFile", "epp.hostModel", "general.registryDataModel" ], "Name" : "Registry Data Escrow (RDE)", "Order" : "5", "Test-Cases" : "^rde-" }, "StandardSRSGateway" : { "Description" : "The SRS Gateway test suite validates the conformance of the Gateway registry\ninfrastructure of the TLD(s) or RSP, and the synchronisation between primary\nand gateway systems.\n\n# Pass/fail criteria\n\nAs with all other [test suites](#test-suites), for this test suite to pass **all** the listed test cases **MUST** pass: if **any** fail, then the suite as a whole will fail.\n\n# References\n\n* [Standard Amendment Language: Registration Validation per Applicable Law\nwith Proxy](https://www.icann.org/en/system/files/files/standard-amendment-language-registration-validation-with-proxy-18sep19-en.pdf) (PDF)\n", "Input-Parameters" : [ "epp.clid01", "epp.clid01DataModel", "epp.clid02", "epp.clid02DataModel", "epp.hostModel", "epp.hostName", "epp.pwd01", "epp.pwd02", "epp.requiredContactElements", "epp.requiredContactTypes", "epp.serverIssuedClientCertificate01", "epp.serverIssuedClientCertificate02", "epp.supportedContactElements", "epp.loginExtension", "epp.supportedContactPostalInfoTypes", "general.registryDataModel", "rdap.baseURLs", "srsgw.eppClid01", "srsgw.eppClid01DataModel", "srsgw.eppClid02", "srsgw.eppClid02DataModel", "srsgw.eppHostName", "srsgw.eppPwd01", "srsgw.eppPwd02", "srsgw.eppRequiredContactElements", "srsgw.eppRequiredContactTypes", "srsgw.eppSupportedContactElements", "srsgw.rdapBaseURLs", "srsgw.registryDataModel", "srsgw.serverIssuedClientCertificate01", "srsgw.serverIssuedClientCertificate02", "srsgw.loginExtension" ], "Name" : "SRS Gateway", "Order" : "7", "Resources" : [ "epp.clientACL", "epp.client01CSR", "epp.client02CSR", "epp.client01Certificate", "epp.client02Certificate", "epp.client01ChainCert", "epp.client02ChainCert" ], "Test-Cases" : "^srsgw-" } }, "Version" : "2026.04" }