Return-Path: X-Original-To: dnsop@mail2.ietf.org Delivered-To: dnsop@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B7FD3115DD8F6 for ; Mon, 13 Jul 2026 07:40:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783953645; bh=DneRubYjYeU4mahPw0OELgCf1gJNrmR9wnVBUPe8jRE=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=OVe/220xuMqr6jlqs9tTyhF9ivvCP6kC5Ii8BX9C6DQcJclEY8v+wYEIxthTv2ysM rJzG7iAPxOy2zmc1NImwtrAHSbyq9X+70nQzvTA2othZuhsjS37hm9pnwxRYUVkXzr Ux5SF0+uVR6P02gyJLCN1l0hyhUzcJGuCN1Xx7Dc= X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=strandkip.nl Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxtCkvLwLj22 for ; Mon, 13 Jul 2026 07:40:45 -0700 (PDT) Received: from dane.soverin.net (dane.soverin.net [185.233.34.47]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 5B9F7115DD87B for ; Mon, 13 Jul 2026 07:40:33 -0700 (PDT) Received: from smtp.soverin.net (unknown [10.10.4.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dane.soverin.net (Postfix) with ESMTPS id 4gzQ8T6pK9z17dn; Mon, 13 Jul 2026 14:40:25 +0000 (UTC) Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.99]) by soverin.net (Postfix) with ESMTPSA id 4gzQ8T59WSz3Z; Mon, 13 Jul 2026 14:40:25 +0000 (UTC) Authentication-Results: smtp.soverin.net; dkim=pass (2048-bit key; unprotected) header.d=strandkip.nl header.i=@strandkip.nl header.a=rsa-sha256 header.s=soverin1 header.b=iq5LW8Q+; dkim-atps=neutral DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=strandkip.nl; s=soverin1; t=1783953625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DneRubYjYeU4mahPw0OELgCf1gJNrmR9wnVBUPe8jRE=; b=iq5LW8Q+EZgMRA+2r6/CdivPNPWu0jdXAo/cZXKs/mbTnkI6haO53XAOZKrpVOnpjfKT5n mOsufEGI1wBApkvsdXnvd49RLXOt51NK3dNRLPBjC9CUdy85UE5xWwIH+63+Ik/RXWxLYy mU3ZTDMbw6YkLVud6/y9R66bxMZfelE+Kz2bKA4PsSNgXTc5/Qkf67NnG8i9GaJ4/9rqi3 ZsuRM8sqnkvDmVeqqdpERwDv1Zj/naAyI1FV2Swwjbt2/DArypqYpzP2puZA1932T9xp97 wZcI+7u9Tr3x61t6kMyL/ncKdV3gJJ0kFJzJfpt6VTbgRmCNQUGPMwaXCrxuCg== X-CM-Envelope: MS4xfPIhjEuel5wURG4f39oURUDgm99e7BdC7Ja5zF9UYPaBKmIpLZ7EsY109dU4O8bVEnviZdOGotcmMuTYxHcFpXaqDn8IZ1/wk0+VpbRgicOHzaelTEmp RZyLlW90mGykpU0hfuWMUZlBng2NHosTc8j7wXi2XkT65XfOl7Ovv/ctASS2NwVmvrKjpobSOJF20x+ar7jBu36juUR2o+oGxY2PTP/n3UmoW/p9ayq1yNvx jG6DeFGa3ARiopRM0URlyFGDXYPzBmS1pZdEccoezY4= X-Soverin-Id: 019f5bec-0fa8-7380-81ef-83ba8acd87b7 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Joe Abley Mime-Version: 1.0 (1.0) Date: Mon, 13 Jul 2026 16:40:15 +0200 Message-Id: <54EBD6ED-152A-40E1-9AF1-76AFA2568C6C@strandkip.nl> References: <823a9c08-db41-4615-900a-44e89949f601@isc.org> In-Reply-To: <823a9c08-db41-4615-900a-44e89949f601@isc.org> To: =?utf-8?Q?Petr_=C5=A0pa=C4=8Dek?= X-Spampanel-Class: ham Message-ID-Hash: 465V7DA6LSU3KUMQB5UACRWUIKGKHEAU X-Message-ID-Hash: 465V7DA6LSU3KUMQB5UACRWUIKGKHEAU X-MailFrom: jabley@strandkip.nl X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: dnsop@ietf.org X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_Disclosure_of_Negative_Trust_Anchors_in_DNS_Resp?= =?utf-8?q?onses_=28draft-farrokhi-dnsop-ede-nta-00=29?= List-Id: IETF DNSOP WG mailing list Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 13 Jul 2026, at 16:26, Petr =C5=A0pa=C4=8Dek wrote: >> Clients that require integrity protection of these signals should use an a= uthenticated and encrypted transport between client and resolver, such as DN= S over TLS [RFC7858] or DNS over HTTPS [RFC8484]. See Section 6 of [RFC8914]= for more discussion. >=20 > Could we drop the encryption part? TSIG or SIG(0) is a fine integrity prot= ection, too. No need to encrypt when it's not needed. Thanks, we will make the text more general and avoid the suggestion that enc= rypted transports are the only way. Joe=