Re: [dbound] draft-brotman-rdbd

[Brian Dickson <[e-mail]>]

On Mon, Apr 1, 2019 at 4:42 AM Stephen Farrell <[e-mail]>
wrote:

>
>
> I would entirely agree if DNSSEC deployment were further along.
> However, that is not the case.
>
> As it happens, for the dozen or so small zones I manage, I have
> deployed DNSSEC and it's been pretty easy once we figured out
> how to automate re-signing and getting DS records to the parent.
> (I've yet to do CDS/CDNSKEY stuff but that should improve it
> some when the parent registry supports it.)
>
> But I have also spoken to quite a few people who say they cannot
> deploy DNSSEC or who think DNSSEC doesn't offer them enough to
> be worth the costs.
>

So, just so I understand it, you are saying the deployment of DNSSEC on the
authoritative side is the problem/issue, in terms of scale of deployment,
and in terms of costs and ease of user, reliability, etc?
Do you see other areas where DNSSEC deployment is problematic? I suspect
resolver validation needs some boosting, but IMHO, once authority use
becomes more common, that should sort itself out.

My observation is that what you are stating (about the authoritative
DNSSEC) is mostly anecdotal.
I'd prefer to be informed by statistical information, if it is available.
Or, I'd like to at least provide information (i.e. existence proofs) on
reliability, ease of use, cost, and scale, that might help make the case
that DNSSEC deployment issues are mostly about communication issues,
awareness, and motivation.

E.g. There are large-scale operators of managed DNS services who offer
DNSSEC at little or no extra cost, trivially easy use, proven reliability,
etc.
This would seem to partly contradict the deployment thing, if the only
thing they need to do is turn it on. (Estimated coverage: 60% of zones.)
There are certainly cases where DNSSEC is incompatible (at least
currently), such as CDNs, geo-ip, potential ANAME (and provider-specific
ANAME-like things currently in use).
But aside from those, the barriers to entry have been lowered considerably,
at least in the managed DNS space.

Brian