Re: [dnsext] slave signing, was does making names the same NEED protocol changes at all?

[John Levine <[e-mail]>]

>Requiring slaves to be signers is a major change to the security model.

Maybe, but this isn't the only place it's an issue.

IPv6 rDNS is a can of worms that I'd prefer not to open here, but
making forward and reverse DNS match on consumer IPv6 is another
problem that has no straightforward solution.  One of the possiblities
that keeps coming up is stunt servers that synthesize the records as
needed, which obviously means that if they do DNSSEC they need to have
the signing keys.

R's,
John