DNS protocol test cases

A valid DNSSEC zone using only algorithm 13 (ECDSA P-256).

A valid algorithm 13 answer with a complete, verifiable chain of trust.

The answer has a deliberately invalid algorithm 13 signature and should be rejected by validating resolvers.

The A RRset has an expired algorithm 13 signature, testing enforcement of the RRSIG validity window.

The DNSKEY RRset has a deliberately invalid signature, breaking validation at the zone key.

The signature covering the DNSKEY RRset has expired, testing validity-window enforcement while authenticating the zone key.

A valid DNSSEC zone using only post-quantum algorithm 18 (ML-DSA-44).

A valid ML-DSA-44 answer with a complete, verifiable chain of trust.

The answer has a deliberately invalid ML-DSA-44 signature and should be rejected by supporting validators.

The A RRset has an expired ML-DSA-44 signature, testing validity-window enforcement in resolvers that support algorithm 18.

The DNSKEY RRset has a deliberately invalid ML-DSA-44 signature, breaking validation at the zone key.

The ML-DSA-44 signature covering the DNSKEY RRset has expired, testing validity-window enforcement while authenticating the zone key.

The DS, DNSKEY, and A RRsets provide valid ML-DSA-44 and P-256 paths, testing dual-algorithm validation during migration.

The ML-DSA-44 path is valid while the P-256 path is invalid, testing whether a resolver can upgrade to post-quantum validation.

The P-256 path is valid while the ML-DSA-44 path is invalid, testing whether a resolver prevents a post-quantum downgrade.