ZONEMD record
ZONEMD, defined in RFC 8976, is a DNS record type that holds a cryptographic digest -- a hash -- of an entire zone's contents, letting anything that receives a copy of the zone verify that copy matches what the primary server actually published. A secondary name server (or any other party that obtains a zone, such as over a zone transfer) can recompute the digest over the records it received and compare it to the ZONEMD record included in that same zone, catching accidental corruption or tampering that occurred somewhere between the primary and the receiver. This fills a gap that DNSSEC doesn't cover on its own: DNSSEC's RRSIG signatures authenticate individual records, but nothing in ordinary DNS attests to the completeness and integrity of an entire zone as a single unit, which matters most for zones distributed outside the normal primary-to-secondary path, such as the root zone or files published for offline verification. ZONEMD is optional and additive -- a resolver or secondary that doesn't understand the record type simply ignores it, so publishing one doesn't break compatibility with older software.
By AdminKit team, Netbase JSC · Updated