[dbound] draft-brotman-rdbd

["A. Schulze" <[e-mail]>]

Hello,

I read the draft. In general I like a possibility to express relationships.
As noted by Warren at the mic, there is also a desire to express "no relation" explicitly.

som thoughts/questions:
1.
> We include an optional digital signature mechanism...
why optional? without any signature wouldn't it possible to any third party to express any relationship?

> RDBD is intended to demonstrate a relationship between registered domains, not individual hostnames.

where is the border? May publicsufficlist help defining them?

2.1 / 2.2
as zone apex is likely to be overloaded today, defining something like _drbd.example covering RDBDKEY and RDBD data comes in mind.

editorial:
1, mention DKIM like mechanisms, but 2.1 introduce to me unexpected "The RDBDKEY RR uses the same registries as DNSKEY for its fields."
.. confusing


> The trailing "." representing the DNS root MUST NOT be included in the to-be-signed data,
> so a relating-domain value above might be "example.com" but "example.com."
what's the reason for not making the root explicit?


the current concept I understand as every random domain can express itself as related domain to a relating domain.
That allow enumeration via passive DNS technics for example without putting any effort in validating signatures.
I understand the desire to allow such enumeration but a more privacy friendly version [1],[2] is welcome, too
And, yes, DNSSEC shouldn't be optional. Re-using existing DNSKEYs may make the signature/validation stuff easier.

Andreas

[1] https://mailarchive.ietf.org/arch/msg/dbound/cPUM4AKeowvUPQY3wclWQpAKgEE
[2] https://mailarchive.ietf.org/arch/msg/dbound/tXghAjUAiezkJLA0FlO0Sy__lrQ