Re: [dane] Please help to remediate broken DNSSEC hosting

In message <20141120151716.GQ13179@mournblade.imrryr.org>, Viktor Dukhovni writ
es:
> On Thu, Nov 20, 2014 at 09:29:02AM +0100, Marco Davids (SIDN) wrote:
> 
> > In particular TransIP is a bit of a challenge, because they run their
> > own DNS-software and feel no rush to fix this issue. But rest assured
> > that we will keep on trying to have them improve things.
> 
> At this point the "feel no rush" attitude will cause loss of email
> between SMTP with DANE early adopters to transip sites that employ
> wildcard records.  They really need to get off their rear-ends and
> fix the problem.
> 
> Otherwise, I may need to develop a new unbound feature that considers
> a zone insecure if all its NS records lie in a given blacklisted
> domain.
> 
> I don't suppose it is possible to pressure transip with a threat
> of removal of the problem DS records from the '.nl' registry by
> say 6 months from now if the problem is not addressed?

We have a documented complaints proceedure.  We should follow it.

RFC 1033 COMPLAINTS

   These are the suggested steps you should take if you are having
   problems that you believe are caused by someone else's name server:

   1.  Complain privately to the responsible person for the domain.  You
   can find their mailing address in the SOA record for the domain.

   2.  Complain publicly to the responsible person for the domain.

   3.  Ask the NIC for the administrative person responsible for the
   domain.  Complain.  You can also find domain contacts on the NIC in
   the file NETINFO:DOMAIN-CONTACTS.TXT

   4.  Complain to the parent domain authorities.

   5.  Ask the parent authorities to excommunicate the domain.

With a DNSSEC problem we may want to add a 4.5 step, ask the parent
to remove the DS record.

Mark

> -- 
> 	Viktor.
> 
> _______________________________________________
> dane mailing list
> dane@ietf.org
> https://www.ietf.org/mailman/listinfo/dane
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org