IETF Logo Mail Archive

Re: [DNSOP] Delegation into the interior of a zone?

Grant Taylor <gtaylor@tnetconsulting.net> Fri, 28 December 2018 23:02 UTC

Return-Path: <gtaylor@tnetconsulting.net>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECCEF12426E for <dnsop@ietfa.amsl.com>; Fri, 28 Dec 2018 15:02:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tnetconsulting.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2sZbeoC-0Fy for <dnsop@ietfa.amsl.com>; Fri, 28 Dec 2018 15:02:04 -0800 (PST)
Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [IPv6:2600:3c00:e000:1e9::8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E514130ED4 for <dnsop@ietf.org>; Fri, 28 Dec 2018 15:02:04 -0800 (PST)
Received: from Contact-TNet-Consulting-Abuse-for-assistance by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id wBSN21jw015351 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for <dnsop@ietf.org>; Fri, 28 Dec 2018 17:02:03 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tnetconsulting.net; s=2015; t=1546038123; bh=3nS3xooC+5/AIpkNF0vMFxUCCcKyocSR5UYt8jL6EkQ=; h=Subject:To:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Cc:Content-Disposition: Content-Language:Content-Transfer-Encoding:Content-Type:Date:From: In-Reply-To:Message-ID:MIME-Version:References:Reply-To: Resent-Date:Resent-From:Resent-To:Resent-Cc:Sender:Subject:To: User-Agent; b=QUhQ+N+cve1WtvudUSKhs3lMYZIq56lWpcqqrcY0fTQWIiUSZEQoDRrUfEzPSNm7t gtKnpNOXlCC7hniIZiGqVpZF5TucT8WsQbMk/mehbxlC+6MZHAkSV+N2c6984BvBxI P4cNYogV84jbet4rsSxfYz38eui805Gp/M44lGxQ=
To: dnsop@ietf.org
References: <20181228222732.6BEC3200C09338@ary.qy>
From: Grant Taylor <gtaylor@tnetconsulting.net>
Organization: TNet Consulting
Message-ID: <75210e98-1eac-60a4-426e-f2f8d00b6baf@spamtrap.tnetconsulting.net>
Date: Fri, 28 Dec 2018 16:02:03 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20181228222732.6BEC3200C09338@ary.qy>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms090805000803080009060701"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/5E4zE8ilrdMAf-RBg0HPAAr4vyY>
Subject: Re: [DNSOP] Delegation into the interior of a zone?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Dec 2018 23:02:06 -0000

On 12/28/18 3:27 PM, John Levine wrote:
> I'd think it depends whether invalid delegations bother them, like if, 
> say, ns1.example.com might not be running BIND.

You seem to be conflating the two independent issues at hand:

1)  Use of RFC 2317's CNAME technique vs the NS technique I'm advocating 
(be it to the interior or apex of the zone).

2)  Use of $GENERATE vs manually creating individual records.

#1 is what records to use.  #2 is how to create said records.  Between 
them there are four possible combinations.

  · Use CNAMEs with manual record creation.
  · Use CNAMEs with $GENERATE.
  · Use NS records with manual record creation.
  · Use NS records with $GENERATE.



-- 
Grant. . . .
unix || die

v2.23.0 | Report a Bug | By Email