Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Michael StJohns writes:
> At 06:59 AM 10/23/2008, Ben Laurie wrote:
> >Michael StJohns wrote:
> >
> >I don't understand the rationale behind all this complication.
> >
> >If I chose to point a DNAME at an unsecured domain, then that was my
> >choice, and I should live with it. If I don't want the domain to be
> >unsecured, then I should either not delegate to it, or ensure it is
> >secured by non-protocol means (e.g. by owning the domain myself, by
> >contract, by sufficient purchase of beer for the domain owner, etc.)
> 
> Hi Ben -
> 
> One of the problem we get with DNS is that there are two views of the data (a
> t least) - the publisher's, and the resolver's views. DNSSEC makes this more 
> complicated by the presence or absence of certain trust anchors.
> 
> As publisher, I have a signed domain, and as publisher, I publish a DNAME als
> o pointing at a signed domain.  I've done my due diligence as you suggest - I
> even own the target zone.

	Signing the zones and publishing DS / DLV records is due
	diligence.  At that point you need to trust that the resolver
	operator will do due diligence and configure all known trust
	anchors or use a DLV service.

	Yes there will be configurations that will not return SECURE
	when there is theoretically enough information to return
	SECURE.

	And the simple answer is to just ensure that there is a
	chain of trust from the root to both zones.  If you are
	unhappy about the lack of trust chains lobby your politicians
	and registry operators to get the root and infrastructure
	zones signed.

	This is not something we need to "fix" using technology.
	What we have today is complicated enough to manage without
	having to track cross zone pseudo delegations.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>