[DNSOP] Re: WG Last Call: draft-ietf-dnsop-delext-02 (Ends 2026-05-07)

[Philip Homburg <[e-mail]>]

> Dear dnsop WG,
> 
> the authors of the document said the document is ready for the WGLC
> and the dnsop WG chairs have considered the discussions on the
> mailing list and the state the document and we consider the document
> to be ready for the WGLC.  Hence this message starts a WG Last Call
> for:  draft-ietf-dnsop-delext-02

In my opinion this draft is not ready.

As far as I can tell, this draft can lead to DNSSEC failures.

For example, a DNSSEC validator that is not a resursive resolver could
implement this draft. The validator will notice the ADT bit in a DNSKEY
and for a query type in this range expects either a RRset or a denial
that the type does not exist in the parent zone.

However, if the validator forwards to a recursive resolver that does not 
implement this draft then the recursive resolver will return a proof that
the record does not exist in the child zone. This wil lead to a DNSSEC
failure.