Re: [Add] some background on split DNS with DNSSEC

On item 3,

We could use DNSSEC to prove the PvD dnsZones is truthful to avoid asking the same question of the public DNS.  

However, we already need IPv6 (for RFC8801's PvD) and adding a DNSSEC requirement means we are deeper in the "room of non-deployability", a dreaded space for our D&D character.  That's why split-dns queries the public DNS:  the procedure in split-dns establishes a *similar* proof of domain ownership as DNSSEC could have provided.

-d

> On Nov 9, 2021, at 1:07 PM, Deen, Glenn <Glenn_Deen=40comcast.com@dmarc.ietf.org> wrote:
> 
> Item #1:
> 
> Chair dusting off his fancy chair hat and saying, before this gets too off track  ....
>     - gentle nudge to everyone to stay focused on the core ADD related issues here -
> 
> Item #2:
> 
> ADD may at times be willing to tackle some hard stuff such as how to discover encrypted DNS servers, but ADD is very much not chartered to take on something as impossible as trying to unravel several decades worth of various DNS and naming architecture choices that many of us would very much like to go back and have a second, hopefully wiser attempt at.
> 
> That is a topic that needs a stool, a beverage and the in-person ability to sigh, roll eyes, shake our heads mournfully and show the all wisdom we have gained by learning the consequences that come years later from decisions that may have made perfect sense at the time.
> 
> Item #3:
> 
> That said, what ADD is chartered to do is to look at how to do encrypted DNS resolver discovery in the environments that users do live in, and not just environments that we think they should be in, so with the background on DNSSEC that started this chain, and EKR's moment of actually putting a good word in for DNSSEC during the ADD session,  does the group see there being a role here for DNSSEC?
> 
> -glenn
> 
> 
> 
> -- 
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add