Is it possible to use NSEC3 resource records with RSASHA256 keys or does NSEC3 require using NSEC3RSASHA1 or NSEC3DSA keys?
The reason why
RSASHA1 was assigned a separate identifier for use together with
NSEC3 is that
RSASHA1 had been defined and already been in use for a long time before
Thus, when introducing
NSEC3 it was deemed best for compatibility with existing deployed software to not extend how
RSASHA1 should work but to present the updated spec as an entirely new algorithm
RSASHA1-NSEC3-SHA1 which existing software would clearly recognize that it did not support instead of incorrectly using its
NSEC-only code with
As you can see in the listing of the assigned DNSSEC algorithms, there are no
NSEC3 variations for any newer algorithms.