[dd] Re: DELEG and draft-ietf-deleg-requirements

[Petr Špaček <[e-mail]>]

On 12. 11. 25 13:32, Dave Lawrence wrote:
> Philip Homburg writes:
>> Similarly, if a query with DE=1 results in a delegation using DELEG
>> records then the same query with DE=0 SHOULD/MUST result in a
>> delegation with NS records.
> 
> This might surprise you, but I agree.  We can say that.  My main
> positions are that we should not require NS records that point to
> usable nameservers, and NS records should not be generated from DELEG
> records directly.
> 
> On the first, we already don't demand NS records like that, even in a
> pre-DELEG world.
> 
> On the second, it means putting more stuff in the DELEG record whose
> only point is to be used for synthesis, which can be achieved by other
> means.  It is an unnecessary complication in the DELEG RR.
> 
> I'd be pretty content with something like:
> 
>    * when answering a DE=0 / DELEG-only query, use [delegation-to-nowhere]
>    * [delegation-to-nowhere] might well be "NS ." (works with your text above)
>    * zone generators are free to use external mechanisms to get
>      different behavior for other possible NS records

My view:
- Currently all variants (NS only, DELEG only, NS+DELEG) are technically 
possible within the current wire protocol spec.
- There is no _technical_ reason for limiting this.

If particular operators of authoritative servers want to always have NS 
present - sure that's local policy. IETF should not be making policy 
decisions for protocol users, which are a very broad group.

During IETF 124 me and Ralf spoke to 4 different registries and none 
objected to the current protocol definition (all variants possible).


Another reason to NOT hard-wire NS synthesis to spec is that it might 
limit possibilities of how to implement it:
- It might be easy to do arbitrary RR generation in with online signing.
- It would be uglier for generic auth with offline signing.
- It can be handled in DNSSEC signer software.
- It can be handled in zone management software, e.g. the thing which 
translates registry database into zone file. Suddenly we are way outside 
scope of DELEG protocol itself.

I don't see any technical reason to prescribe how exactly it should be 
done, when, where and by whom.

-- 
Petr Špaček