IETF Logo Mail Archive

[DNSOP] Re: Disclosure of Negative Trust Anchors in DNS Responses (draft-farrokhi-dnsop-ede-nta-00)

Joe Abley <jabley@strandkip.nl> Mon, 13 July 2026 14:40 UTC

Return-Path: <jabley@strandkip.nl>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B7FD3115DD8F6 for <dnsop@mail2.ietf.org>; Mon, 13 Jul 2026 07:40:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783953645; bh=DneRubYjYeU4mahPw0OELgCf1gJNrmR9wnVBUPe8jRE=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=OVe/220xuMqr6jlqs9tTyhF9ivvCP6kC5Ii8BX9C6DQcJclEY8v+wYEIxthTv2ysM rJzG7iAPxOy2zmc1NImwtrAHSbyq9X+70nQzvTA2othZuhsjS37hm9pnwxRYUVkXzr Ux5SF0+uVR6P02gyJLCN1l0hyhUzcJGuCN1Xx7Dc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=strandkip.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxtCkvLwLj22 for <dnsop@mail2.ietf.org>; Mon, 13 Jul 2026 07:40:45 -0700 (PDT)
Received: from dane.soverin.net (dane.soverin.net [185.233.34.47]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 5B9F7115DD87B for <dnsop@ietf.org>; Mon, 13 Jul 2026 07:40:33 -0700 (PDT)
Received: from smtp.soverin.net (unknown [10.10.4.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dane.soverin.net (Postfix) with ESMTPS id 4gzQ8T6pK9z17dn; Mon, 13 Jul 2026 14:40:25 +0000 (UTC)
Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.99]) by soverin.net (Postfix) with ESMTPSA id 4gzQ8T59WSz3Z; Mon, 13 Jul 2026 14:40:25 +0000 (UTC)
Authentication-Results: smtp.soverin.net; dkim=pass (2048-bit key; unprotected) header.d=strandkip.nl header.i=@strandkip.nl header.a=rsa-sha256 header.s=soverin1 header.b=iq5LW8Q+; dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=strandkip.nl; s=soverin1; t=1783953625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DneRubYjYeU4mahPw0OELgCf1gJNrmR9wnVBUPe8jRE=; b=iq5LW8Q+EZgMRA+2r6/CdivPNPWu0jdXAo/cZXKs/mbTnkI6haO53XAOZKrpVOnpjfKT5n mOsufEGI1wBApkvsdXnvd49RLXOt51NK3dNRLPBjC9CUdy85UE5xWwIH+63+Ik/RXWxLYy mU3ZTDMbw6YkLVud6/y9R66bxMZfelE+Kz2bKA4PsSNgXTc5/Qkf67NnG8i9GaJ4/9rqi3 ZsuRM8sqnkvDmVeqqdpERwDv1Zj/naAyI1FV2Swwjbt2/DArypqYpzP2puZA1932T9xp97 wZcI+7u9Tr3x61t6kMyL/ncKdV3gJJ0kFJzJfpt6VTbgRmCNQUGPMwaXCrxuCg==
X-CM-Envelope: MS4xfPIhjEuel5wURG4f39oURUDgm99e7BdC7Ja5zF9UYPaBKmIpLZ7EsY109dU4O8bVEnviZdOGotcmMuTYxHcFpXaqDn8IZ1/wk0+VpbRgicOHzaelTEmp RZyLlW90mGykpU0hfuWMUZlBng2NHosTc8j7wXi2XkT65XfOl7Ovv/ctASS2NwVmvrKjpobSOJF20x+ar7jBu36juUR2o+oGxY2PTP/n3UmoW/p9ayq1yNvx jG6DeFGa3ARiopRM0URlyFGDXYPzBmS1pZdEccoezY4=
X-Soverin-Id: 019f5bec-0fa8-7380-81ef-83ba8acd87b7
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Joe Abley <jabley@strandkip.nl>
Mime-Version: 1.0 (1.0)
Date: Mon, 13 Jul 2026 16:40:15 +0200
Message-Id: <54EBD6ED-152A-40E1-9AF1-76AFA2568C6C@strandkip.nl>
References: <823a9c08-db41-4615-900a-44e89949f601@isc.org>
In-Reply-To: <823a9c08-db41-4615-900a-44e89949f601@isc.org>
To: Petr Špaček <pspacek@isc.org>
X-Spampanel-Class: ham
Message-ID-Hash: 465V7DA6LSU3KUMQB5UACRWUIKGKHEAU
X-Message-ID-Hash: 465V7DA6LSU3KUMQB5UACRWUIKGKHEAU
X-MailFrom: jabley@strandkip.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Disclosure of Negative Trust Anchors in DNS Responses (draft-farrokhi-dnsop-ede-nta-00)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/3EdPNZTeAiwKZgPD76y38RqgFps>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

On 13 Jul 2026, at 16:26, Petr Špaček <pspacek@isc.org> wrote:

>> Clients that require integrity protection of these signals should use an authenticated and encrypted transport between client and resolver, such as DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484]. See Section 6 of [RFC8914] for more discussion.
> 
> Could we drop the encryption part? TSIG or SIG(0) is a fine integrity protection, too. No need to encrypt when it's not needed.

Thanks, we will make the text more general and avoid the suggestion that encrypted transports are the only way.


Joe

v2.46.0 | Report a Bug | By Email | System Status