[dd] Re: Security Considerations: NS Weaker Than DELEG

[Dave Lawrence <[e-mail]>]

Joe Abley writes:
> Related, in draft-ietf-deleg-requirements we see:
> 
> S5. DELEG should allow for backward compatibility to the
...

We also see:

  "Soft requirements" are those that are desirable, but the absence of
   which does not intrinsically eliminate a design.  These will largely
   be descriptive of the problems that are trying to be addressed with a
   new method, or features that would ease adoption.

The document also doesn't say anywhere that these features have to be
built into the wire protocol itself.

Under the DELEG protocol as currently described, operators are still
free to have local policy that demands that all zones they operate are
reachable via both DELEG and NS, and can derive that capability from
whatever single source of truth they want to use on the backend.
Authoritative server authors are more than welcome to provide such a
feature as a way to ease adoption.

The existing DNS also doesn't demand that all delegations are useful
to all resolvers.

Zone operators who are serving zones that have DELEG-only delegations
are already indicating that they don't care if the zone is unreachable
by some subset of clients, so the legacy resolver fronting a
DELEG-aware resolver scenario, while interesting, is not a problem
that needs solving.