[dd] FYI, my drafts for discussion uploaded, was Re: Re: A generalised delegation extension mechanism

[Paul Wouters <[e-mail]>]

On Wed, 22 May 2024, Roy Arends wrote:

> The secure signal (a dedicated DNSKEY or DS type) by which resolvers expect proof of non-existent types at delegations (as we have for DS records) should not just be tied to DELEG, but should be used in all new delegation type responses.
>
> The document that describes this should be separate and independent of the DELEG type description.

I agree, and since:

>> The following is based on [1] by Petr Spacek and Peter van Dijk and conversations with Paul Wouters and Ben Schwartz (This namedropping should not be seen as endorsements for the following, but merely credit where credit is due).

>> Future "parent side only” record types should not require a new signalling mechanism. (Paul Wouters insight, and I agree)

I had written two drafts, after I gave a presentation at the DNSOP
interim, which I had shared with some people but didn't feel ready
to submit yet, but I think it would be good purely to facilitate
discussion, so I just uploaded them:

https://datatracker.ietf.org/doc/draft-pwouters-parental-rrtype/
(I didn't know about draft-peetterr-dnsop-parent-side-auth-types-00, my
  drafts adds a lot more proposal than just the scaffolding offered in
the other document though)

https://datatracker.ietf.org/doc/draft-pwouters-ds-uplifting/
(this draft defines an "alias DS" and a "meta-parental-rrtype-in-ds")

What I was pondering about still is that while this is the technical
sound way of doing things, is whether the ship already sailed and we
might as well try do just do one super generic DS-overload-DELEG style
record.

Paul