Re: [dns-privacy] [Ext] next steps for draft-opportunistic-adotq

[Ben Schwartz <[e-mail]>]

On Tue, Mar 23, 2021 at 10:59 AM Paul Hoffman <[e-mail]>
wrote:

> On Mar 23, 2021, at 7:16 AM, Brian Haberman <[e-mail]>
> wrote:
>
...

> > Is there an issue with putting SVCB info in the TLD zones? If I
> > interpret this ICANN document correctly
> > (
> https://newgtlds.icann.org/sites/default/files/agreements/agreement-approved-31jul17-en.html#exhibitA.1
> ),
> > there are strict limitations on the info that can be put in the TLD
> zones.
>
> There are currently such limitations, and only in gTLDs. If the IETF
> creates a standard that would cause zone owners to want additional record
> types in their zones, I suspect that the technical and gTLD operator
> communities will talk to ICANN about changing the contracts.
>

Paul, are you referring to the linked "Registry Agreement" or is there
another contract document?

The "Registry Agreement" says that "permissible contents" include "NS
records and in-bailiwick glue for DNS servers of registered names in the
TLD".  It seems to me that the IETF defines what constitutes "in-bailiwick
glue".  In my view, if there is an NS record for $NSNAME, and $NSNAME is
in-bailiwick, then any record under $NSNAME that is used by resolvers to
connect to the nameserver in accordance with IETF standards is in-bailiwick
glue, regardless of RR type.

In other words, this agreement seems compatible with our SVCB- and
TLSA-based designs.

Said a different way: if this WG wants to have a mechanism for
> authoritative discovery that involves adding new glue-like records in
> parent zones, it should not be constrained by current contracts that could
> be changed in the future.


I agree; I'm just wondering how sure we are that such a change is needed.