Re: [dd] DS pinning for secondaries

[Paul Wouters <[e-mail]>]

On Tue, 27 Feb 2024, Petr Špaček wrote:

> Today I've presented DELEG work to CENTR Tech group [1] and there was a 
> request to support use-case where ALIAS points to secondaries who are 
> supposed to serve signed version of the zone, but cannot resign it 
> themselves.
>
> In my mind that translates to syntax like this:
>
> signed.example.net. DELEG 0 operator.example. ds="12345678"

Why not a regular DS at the parent to lock this? And only use DELEG
for NS/glue.

Or rather, what would this use case gain from a DELEG record, other
than various transport security options?

You would also need a signal for this. Combing alias + non-alias seems
to open pandoras box of contradictions and complicated error paths. It
seems the easiest signal is the old fashioned DS record trumping DELEG
ds= entries.

Paul