Re: [dd] DS pinning for secondaries

[Petr Špaček <[e-mail]>]

On 27. 02. 24 18:31, Paul Wouters wrote:
> On Tue, 27 Feb 2024, Petr Špaček wrote:
> 
>> Today I've presented DELEG work to CENTR Tech group [1] and there was 
>> a request to support use-case where ALIAS points to secondaries who 
>> are supposed to serve signed version of the zone, but cannot resign it 
>> themselves.
>>
>> In my mind that translates to syntax like this:
>>
>> signed.example.net. DELEG 0 operator.example. ds="12345678"
> 
> Why not a regular DS at the parent to lock this? And only use DELEG
> for NS/glue.

Makes sense to me - if we think through various compatibility scenarios 
with legacy vs. DELEG-aware clients.

> 
> Or rather, what would this use case gain from a DELEG record, other
> than various transport security options?

ALIAS allows to offload NS RRset maintenance to operator who IMHO 
logically should be in charge of _technical parameters_ how to connect 
to auths.

I.e. even without fancy extra parameters the operator will get ability 
to modify NS set, which is will simplify operations.

> You would also need a signal for this. Combing alias + non-alias seems
> to open pandoras box of contradictions and complicated error paths. It
> seems the easiest signal is the old fashioned DS record trumping DELEG
> ds= entries.

-- 
Petr Špaček