explain alg/type and link to more docs

howto/dns.md

@@ -113,9 +113,9 @@ be in Joker. you need to add the new one.
 
 With the above, you would have the following in Joker:
 
- * `alg`: 8
+ * `alg`: 8 ("RSA/SHA-256", [IANA](https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml), [RFC5702](https://www.rfc-editor.org/rfc/rfc5702.html))
  * `digest`: ebdf81e6b773f243cdee2879f0d12138115d9b14d560276fcd88e9844777d7e3
- * `type`: 2
+ * `type`: 2 ("SHA-256", [IANA](https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml), [RFC4509](https://www.rfc-editor.org/rfc/rfc4509.html))
  * `keytag`: 57040
 
 And click "save".
@@ -155,7 +155,7 @@ to perform those updates on its own.
 Further, puppet ships trust anchors for some of our zones to our unbounds.  If
 you updated the DS for one of those, update the corresponding file in
 `tsa-puppet/modules/unbound/files`.  Existing machines don't need that (since
-we do slow, RFC5011-style rolling of KSKs), but new instances will be sad if we
+we do slow, [RFC5011](https://www.rfc-editor.org/rfc/rfc5011.html)-style rolling of KSKs), but new instances will be sad if we
 ship them obsolete trust anchors.
 
 ### Special case: RFC1918 zones