Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex

[Shumon Huque <[e-mail]>]

On Sat, Jun 23, 2018 at 10:45 PM Paul Vixie <[e-mail]> wrote:

>
> Joe Abley wrote:
> > I think a pragmatic solution needs to work in unsigned zones.
> >
> > ...
>
> can someone ask the IAB to rule on whether any new internet technology
> standard should address unsigned DNS zones, or for that matter, IPv4
> networks?
>

I have to agree with Joe here.

I have no problem with the IAB/IETF requiring that new DNS enhancements
need to be compatible with and work with DNSSEC - and I support that
requirement. But if they don't also work with unsigned zones, then they
will face a critical deployment obstacle in today's Internet environment,
where DNSSEC is still largely undeployed. So I think for each new
enhancement proposal, we need to evaluate this obstacle, and determine if
it's worth doing the work.

In particular, for the various type specific alias proposals that are the
topic of this thread, the target audience is extensively deployed sites on
the Internet. And if you survey all the sites that use apex CNAME hacks
today, I suspect that you will find a very small minority of them have
deployed DNSSEC. And so, if the proposed solution requires DNSSEC, it is
not really solving the problem in the field. Maybe it will a decade down
the road (if DNSSEC gets wide update by then, which is by no means
certain), but I assume we want to solve the problem on a somewhat smaller
time frame.

Shumon.