[dns-at-ietf] Re: DNSSEC: (was: Community consensus report on DNS WG structures at IETF)

[Paul Hoffman <[e-mail]>]

On 13 Feb 2026, at 0:22, Philip Homburg wrote:

>> A simple solution to this would be to add a third WG to DNSPROT
>> and DNSDEP: the DNSSEC WG. This would absorb all the current and
>> future DNSSEC-related work, leaving DNSPROT to focus on work that
>> is for the core of the DNS protocols, and leaving DNSDEP to focus
>> on the operational issues with the DNS that are unrelated (or just
>> mildly adjacent) to DNSSEC. The text about DNSDISPATCH would be
>> mostly left alone, but adding in the ability to send things to
>> DNSSEC.
>
> Can you explain a bit more how this would work?

Some have suggested that there be a separate way to go fetch large keys for algorithms with particularly large keys that have long lifetimes. (I happen to dislike this idea, but it has come up more than once.)

> Though there might be enough 'pure' DNSSEC work to warrant a separate
> WG. We did have some pure DNSSEC work, the well-known algorithms draft,
> the lifecycle draft, the new hash algorithms for private algorithms draft.

Looking at the work list for the current DNSOP WG, I believe that there is. I also believe that the people involved in it have specific talents and understandings, honed over a few decades, that many others do not.

--Paul Hoffman