I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in validating resolvers.
Is it practical to sign Internet zones (those I'm particularly interested in are
.org domains) with SHA-256, or am I making my zone unverifiable to large swathes of the DNSSEC-aware Internet?
As a follow-up, can key schedules change with a hash change to keep the same level of security (e.g. can I work around using SHA-1 by having shorter key schedules)?