Re: [dbound] draft-brotman-rdbd

[Stephen Farrell <[e-mail]>]

Hiya,

On 01/04/2019 19:18, Brian Dickson wrote:
> On Mon, Apr 1, 2019 at 4:42 AM Stephen Farrell <[e-mail]>
> wrote:
> 
>>
>>
>> I would entirely agree if DNSSEC deployment were further along.
>> However, that is not the case.
>>
>> As it happens, for the dozen or so small zones I manage, I have
>> deployed DNSSEC and it's been pretty easy once we figured out
>> how to automate re-signing and getting DS records to the parent.
>> (I've yet to do CDS/CDNSKEY stuff but that should improve it
>> some when the parent registry supports it.)
>>
>> But I have also spoken to quite a few people who say they cannot
>> deploy DNSSEC or who think DNSSEC doesn't offer them enough to
>> be worth the costs.
>>
> 
> So, just so I understand it, you are saying the deployment of DNSSEC on the
> authoritative side is the problem/issue, in terms of scale of deployment,
> and in terms of costs and ease of user, reliability, etc?
> Do you see other areas where DNSSEC deployment is problematic? I suspect
> resolver validation needs some boosting, but IMHO, once authority use
> becomes more common, that should sort itself out.

Seems a bit of a side-issue for this discussion but happy to
discuss off-list. (I do think launching into each of our ideas
as to what's good or bad about DNSSEC would be distracting
here and more on-topic e.g. for dnsop and not this list.)

> 
> My observation is that what you are stating (about the authoritative
> DNSSEC) is mostly anecdotal.

Sadly not.

[1] seems to show that <1% of .com 2lds are signed and barely
more than 1% of .net 2lds.

[2] provides a bit of a basis for limited optimism but still
shows around about 1 million signed 2lds despite some ccTLDs
offering small financial incentives to those who sign.

A 2018 peer-reviewed paper [3] ([4] for non-paywall) including
Roland Van Rijswijk-Deij as an author (whom I at least would
trust on this) says that "The security extensions to the DNS
(DNSSEC) currently cover approximately 3% of all domains
worldwide." (Which I guess can be consistent with the above
given depth inside signed zones.)

FWIW my general position is that we ought be making DNSSEC
easier to use where we can, and we should encourage deployment
but we cannot really make it a dependency for pretty much any
new protocol, or that new protocol will be extremely constrained
in where it can be deployed. (The optional RDBD signature
mechanism is consistent with that, in that it kinda tries to
spread the benefits of DNSSEC to an RR from the related domain,
if the relating domain is DNSSEC signed but the related domain
is not.)

Cheers,
S.

[1] https://www.statdns.com/
[2] https://stats.dnssec-tools.org/
[3] https://ieeexplore.ieee.org/abstract/document/8406223/
[4]
https://research.tue.nl/en/publications/economic-incentives-on-dnssec-deployment-time-to-move-from-quanti

> I'd prefer to be informed by statistical information, if it is available.
> Or, I'd like to at least provide information (i.e. existence proofs) on
> reliability, ease of use, cost, and scale, that might help make the case
> that DNSSEC deployment issues are mostly about communication issues,
> awareness, and motivation.
> 
> E.g. There are large-scale operators of managed DNS services who offer
> DNSSEC at little or no extra cost, trivially easy use, proven reliability,
> etc.
> This would seem to partly contradict the deployment thing, if the only
> thing they need to do is turn it on. (Estimated coverage: 60% of zones.)
> There are certainly cases where DNSSEC is incompatible (at least
> currently), such as CDNs, geo-ip, potential ANAME (and provider-specific
> ANAME-like things currently in use).
> But aside from those, the barriers to entry have been lowered considerably,
> at least in the managed DNS space.
> 
> Brian
>