Extension and design of secure dynamic updates in domain name systems

Previous IETF proposals for the secure dynamic updates in the DNS dictate that any DNS update requests are restricted to the same zone as the requester. This limits the flexibility and applicability of many servers such as certificate authority (CA) servers. We propose to use two more bits in the DNS header section to define the scope of the zones over which a dynamic update key has an update access right. These bits are called scope control bits. We also describe how requests for dynamic updates can be generated and processed in the resolver and the DNS servers using these scope control bits.