Re: [Add] some background on split DNS with DNSSEC

["Deen, Glenn" <[e-mail]>]

Item #1:

Chair dusting off his fancy chair hat and saying, before this gets too off track  ....
     - gentle nudge to everyone to stay focused on the core ADD related issues here -

Item #2:

ADD may at times be willing to tackle some hard stuff such as how to discover encrypted DNS servers, but ADD is very much not chartered to take on something as impossible as trying to unravel several decades worth of various DNS and naming architecture choices that many of us would very much like to go back and have a second, hopefully wiser attempt at.

That is a topic that needs a stool, a beverage and the in-person ability to sigh, roll eyes, shake our heads mournfully and show the all wisdom we have gained by learning the consequences that come years later from decisions that may have made perfect sense at the time.

Item #3:

That said, what ADD is chartered to do is to look at how to do encrypted DNS resolver discovery in the environments that users do live in, and not just environments that we think they should be in, so with the background on DNSSEC that started this chain, and EKR's moment of actually putting a good word in for DNSSEC during the ADD session,  does the group see there being a role here for DNSSEC?

-glenn