Re: Opt-in wg last call

[Paul Vixie <[e-mail]>]

Mats Dufberg <[e-mail]> writes:

> The only arguments in favor of limited opt-in I have seen have been on
> some kind of moral ground. Are there any technical arguments that I cannot
> see in favor of limiting opt-in?

I have seen no such technical arguments.

> When administrating DNS you are focused on the zone as a unit. DNSsec has
> also focused on that unit. But queries are not based on zone, and they can
> happily skip zones when parent and child resides on the same server, or
> some server happens to do resolving. Queries are based on names and its
> data, and opt-in refocus on names as being secured or not.

Agreed.  (And: "well put.")

> ... until I see good technical grounds for limiting opt-in, I propose
> full opt-in.

Echoed.

The document can recommend an operational practice of only opting in/out
one's delegations.  But implementations (of either server or client) should
not be required to enforce this practice, since at the wire level, it is
arbitrary, and only adds complexity without removing any carrying cost.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>