Re: [dbound] [EXTERNAL] Re: RDBD 01 Comments

[Grant Taylor <[e-mail]>]

On 3/22/19 7:01 AM, Brotman, Alexander wrote:
> The original intent was a providing a bit more of a hurdle to falsifying 
> responses.

I need to re-read things, but I don't recall why anything needs to be 
complex.  Why can't DomainA.example publish a (simple) record stating 
that it asserts a relationship with DomainB.example.  Ideally, vice versa.

> I didn't think we could realistically rely on DNSSEC as a requirement 
> (I'm imagining a situation where we have DNSSEC, and someone goes off 
> to Route53 to host a domain where DNSSEC is not supported last I knew),

IMHO, more and more things significantly benefit from (if not actually 
need) DNSSEC.  As such, I think we should quite coddling things that 
don't support DNSSEC.  Especially when we are designing things for the 
future.  Design for what we want.  At least unless there is a 
significant reason to not use something like DNSSEC.

Also, I do believe that if enough people want to use technologies that 
need DNSSEC, they can exert enough market pressure to get Route53 (et 
al.) to support DNSSEC.



-- 
Grant. . . .
unix || die